IN THE UNITED STATES COURT OF FEDERAL CLAIMS 

BID PROTEST 


) 

ORACLE AMERICA, INC. ) 

) 

Plaintiff, ) 

) 

v. ) 

) 

THE UNITED STATES, ) 

) 

Defendant. ) 

_ ) 


Case No. 


18-1880 C 


ORDER GRANTING PLAINTIFF'S MOTION FOR LEAVE TO FILE 
COMPLAINT AND PROPOSED REDACTED COMPLAINT UNDER SEAL AND 

MOTION FOR PROTECTIVE ORDER 

This matter having come before the Court on Plaintiffs Motion for Leave to File 
Complaint and Proposed Redacted Complaint under Seal and Motion for Protective Order, and 
the Court being fully apprised of the premises and having considered any opposition thereto, it is 

this_day of December 2018 by the United States Court of Federal Claims: 

ORDERED that the Motion for Leave to File Complaint and Proposed Redacted 
Complaint Under Seal is GRANTED; and it is 

FURTHER ORDERED that said pleadings shall be held under seal; and it is 
FURTHER ORDERED that the Motion for Protective Order is GRANTED; and it is 
FURTHER ORDERED that the attached Protective Order shall cover all protected 
material filed in this matter including the pleadings and supporting documents sealed by this 
Order. 


Court of Federal Claims Judge 



FORM 8 

PROTECTIVE ORDER IN PROCUREMENT PROTEST CASES 

®mtetr States Court of jfeberal Claims 


) 

) 

Oracle America, Inc. ) 


) No. _ 

Plaintiff, ) 

) Judge 

v. ) 

) 

THE UNITED STATES, ) 

) 

Defendant. ) 


PROTECTIVE ORDER 


The court finds that certain information likely to be disclosed orally or in writing during the course of 
this litigation may be competition-sensitive or otherwise protectable and that entry of a Protective Order is 
necessary to safeguard the confidentiality of that information. Accordingly, the parties shall comply with 
the terms and conditions of this Protective Order. 


I. 

1. Protected Information Defined . “Protected information” as used in this order means information that 
must be protected to safeguard the competitive process, including source selection information, 
proprietary information, and confidential information contained in: 

(a) any document (e.g., a pleading, motion, brief, notice, or discovery request or response) 
produced, filed, or served by a party to this litigation; or 

(b) any deposition, sealed testimony or argument, declaration, or affidavit taken or provided 
during this litigation. 

2. Restrictions on the Use of Protected Information . Protected information may be used solely for the 
purposes of this litigation and may not be given, shown, made available, discussed, or otherwise 
conveyed in any form except as provided herein or as otherwise required by federal statutory law. 
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II. 


3. Individuals Permitted Access to Protected Information . Except as provided in paragraphs 7 and 8 
below, the only individuals who may be given access to protected information are counsel for a party 
and independent consultants and experts assisting such counsel in connection with this litigation. 

4. Applying for Access to Protected Information . An individual seeking access to protected information 
pursuant to Appendix C, Section VI of this court’s rules must read this Protective Order; must complete 
the appropriate application form (Form 9—“Application for Access to Information Under Protective 
Order by Outside or Inside Counsel,” or Form 10—“Application for Access to Information Under 
Protective Order by Expert Consultant or Witness”); and must file the executed application with the 
court. 

5. Objecting to an Application for Admission . Any objection to an application for access must be filed 
with the court within two (2) business days of the objecting party’s receipt of the application. 

6. Receiving Access to Protected Information . If no objections have been filed by the close of the second 
business day after the other parties have received the application, the applicant will be granted access 
to protected information without further action by the court. If any party files an objection to an 
application, access will only be granted by court order. 

7. Access to Protected Information by Court, Department of Justice, and Agency Personnel . Personnel 
of the court, the procuring agency, and the Department of Justice are automatically subject to the terms 
of this Protective Order and are entitled to access to protected information without further action. 

8. Access to Protected Information by Support Personnel . Paralegal, clerical, and administrative support 
personnel assisting any counsel who has been admitted under this Protective Order may be given access 
to protected information by such counsel if those personnel have first been informed by counsel of the 
obligations imposed by this Protective Order. 

III. 

9. Identifying Protected Information . Protected information may be provided only to the court and to 
individuals admitted under this Protective Order and must be identified as follows: 

(a) if provided in electronic form, the subject line of the electronic transmission shall read 
“CONTAINS PROTECTED INFORMATION ”; or 

(b) if provided in paper form, the document must be sealed in a parcel containing the legend 
“PROTECTED INFORMATION ENCLOSED” conspicuously marked on the outside. 

The first page of each document containing protected information, including courtesy copies for use 
by the judge, must contain a banner stating “Protected Information to Be Disclosed Only in 
Accordance With the U.S. Court of Federal Claims Protective Order” and the portions of any 
document containing protected information must be clearly identified. 

10. Filing Protected Information . Pursuant to this order, a document containing protected information may 
be filed electronically under the court’s electronic case filing system using the appropriate activity listed 
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in the “SEALED” documents menu. If filed in paper form, a document containing protected 
information must be sealed in the manner prescribed in paragraph 9(b) and must include as an 
attachment to the front of the parcel a copy of the certificate of service identifying the document being 
filed. 

11. Protecting Documents Not Previously Sealed . If a party determines that a previously produced or filed 
document contains protected information, the party may give notice in writing to the court and the other 
parties that the document is to be treated as protected, and thereafter the designated document must be 
treated in accordance with this Protective Order. 


IV. 

12. Redacting Protected Documents For the Public Record . 

(a) Initial Redactions . After filing a document containing protected information in accordance 
with paragraph 10, or after later sealing a document pursuant to paragraph 11, a party must 
promptly serve on the other parties a proposed redacted version marked “Proposed Redacted 
Version” in the upper right-hand corner of the first page with the claimed protected 
information deleted. 

(b) Additional Redactions . If a party seeks to include additional redactions, it must advise the 
filing party of its proposed redactions within two (2) business days after receipt of the 
proposed redacted version, or such other time as agreed upon by the parties. The filing party 
must then provide the other parties with a second redacted version of the document clearly 
marked “Agreed-Upon Redacted Version” in the upper right-hand corner of the page with 
the additional information deleted. 

(c) Final Version . At the expiration of the period noted in (b) above, or after an agreement 
between the parties has been reached regarding additional redactions, the filing party must file 
with the court the final redacted version of the document clearly marked “Redacted Version” 
in the upper right-hand corner of the first page. This document will be available to the public. 

(d) Objecting to Redactions . Any party at any time may object to another party’s designation of 
certain information as protected. If the parties are unable to reach an agreement regarding 
redactions, the objecting party may submit the matter to the court for resolution. Until the 
court resolves the matter, the disputed information must be treated as protected. 

V. 

13. Copying Protected Information . No party, other than the United States, may for its own use make more 
than three (3) copies of a protected document received from another party, except with the consent of 
all other parties. A party may make additional copies of such documents, however, for filing with the 
court, service on the parties, or use in discovery and may also incorporate limited amounts of protected 
information into its own documents or pleadings. All copies of such documents must be clearly labeled 
in the manner required by paragraph 9. 

14. Waiving Protection of Information . A party may at any time waive the protection of this order with 
respect to any information it has designated as protected by advising the court and the other parties in 
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writing and identifying with specificity the information to which this Protective Order will no longer 
apply. 

15. Safeguarding Protected Information . Any individual admitted under this Protective Order must take 
all necessary precautions to prevent disclosure of protected information, including but not limited to 
physically securing, safeguarding, and restricting access to the protected information. 

16. Breach of the Protective Order . If a party discovers any breach of any provision of this Protective 
Order, the party must promptly report the breach to the other parties and immediately take appropriate 
action to cure the violation and retrieve any protected information that may have been disclosed to 
individuals not admitted under this Protective Order. The parties must reasonably cooperate in 
determining the reasons for any such breach. 

17. Seeking Relief From the Protective Order . Nothing contained in this order shall preclude a party from 
seeking relief from this Protective Order through the filing of an appropriate motion with the court 
setting forth the basis for the relief sought. 

VI. 

18. Maintaining Filed Documents Under Seal . The court will maintain properly marked protected 
documents under seal throughout this litigation. 

19. Retaining Protected Information After the Termination of Litigation . Upon conclusion of this action 
(including any appeals and remands), the original version of the administrative record and any other 
materials that have been filed with the court under seal will be retained by the court pursuant to RCFC 
77.3(c). Copies of such materials may be returned by the court to the filing parties for disposition in 
accordance with paragraph 20 of this Protective Order. 

20. Disposing of Protected Information . Within thirty (30) days after the conclusion of this action 
(including any appeals and remands), each party must destroy all protected information received 
pursuant to this litigation and certify in writing to each other party that such destruction has occurred 
or must return the protected information to the parties from which the information was received. With 
respect to protected electronically stored information (ESI) stored on counsel’s computer network(s), 
destruction of such ESI for purposes of compliance with this paragraph shall be complete when counsel 
takes reasonable steps to delete all such ESI from the active email system (such as, but not limited to, 
the “Inbox,” “Sent Items,” and “Deleted Items” folders) of admitted counsel and of any personnel who 
received or sent emails with protected information while working under the direction and supervision 
of such counsel, and by deleting any protected ESI from databases under counsel’s control. Compliance 
with this paragraph does not require counsel to search for and remove ESI from any computer network 
back-up tapes, disaster recovery systems, or archival systems. Each party may retain one copy of such 
documents, except when the retention of additional copies is required by federal law or regulation, 
provided those documents are properly marked and secured. 
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IT IS SO ORDERED. 


Judge 
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3fn tlje llniteb States Court of Jftimal Claims 

No. 18-1880C 
(Filed: December 7, 2018) 


ORACLE AMERICA, INC., 
Plaintiff, 


v. 


THE UNITED STATES, 

Defendant. 


ORDER 


For good cause shown, the court grants plaintiffs motion for leave to 
file its complaint, proposed redacted complaint, and supporting documents 
under seal. The court also grants plaintiffs motion for a protective order. 


s/Eric G. Bruggink 
ERIC G. BRUGGINK 
Senior Judge 
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IN THE UNITED STATES COURT OF FEDERAL CLAIMS 

BID PROTEST 

ORACLE AMERICA, INC., 

Plaintiff, 
v. 

THE UNITED STATES, 

Defendant. 

BID PROTEST COMPLAINT 

Plaintiff Oracle America, Inc. ("Oracle"), by its undersigned counsel, hereby protests 
several aspects of Department of Defense ("the Agency" or "DoD") Solicitation No. HQ0034-18- 
R-0077 (the "RFP"), commonly referred to as the Joint Enterprise Defense Infrastructure 
("JEDI") Cloud procurement. The ten-year, ten billion dollar, Indefinite Delivery Indefinite 
Quantity ("IDIQ") RFP solicits a single awardee to provide infrastructure as a service ("IaaS") 
and platform as a service ("PaaS") cloud services across the entire DoD enterprise. 

I. INTRODUCTION 

1. An unfamiliar technology to most just ten years ago, cloud computing has 
fundamentally transformed the information technology ("IT") industry. Even so, with machine 
learning, big data, internet of things, and other advances, the pace of cloud computing change is 
accelerating . The rapid pace of technological change, the need to leverage the best technologies 
available for the particular job, cost competition, information security advantages, and vendor 
lock-in concerns have led to the commercial and government marketplace predominantly 
employing multi-cloud solutions. To that end, on Monday, September 24, 2018, the Office of 
Management and Budget ("OMB") released its technology-neutral, vendor-agnostic, draft Cloud 
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Smart strategy, noting: "This plan will be technology-neutral, and will consider vendor-based 
solutions, agency-hosted solutions, inter- and intra-agency shared services, multi-cloud, and 
hybrid solutions as appropriate." 1 Numerous DoD agencies also have adopted multi-cloud 
approached for these same reasons - including during the JEDI Cloud procurement. 

2. Yet, ignoring Congressional concerns (including both longstanding statutory 
admonitions and a recent National Defense Authorization Act ("NDAA") provision contradicting 
DoD's stated JEDI Cloud acquisition strategy), trade industry warnings, public watchdog alarm, 
and competitor complaints, DoD has persisted with an RFP seeking a single vendor to provide 
the IaaS and PaaS cloud services (unclassified to classified, mundane to forward deployed) 
intended to host 80% of DoD's applications across a ten-vear contract . 2 

3. But it is not merely the massive size and scope of the solicited contract or even 
the single source requirement (as confounding as it is) that has led to persistent Congressional 
scrutiny, press coverage, and now apparently an Inspector General inquiry for the JEDI Cloud 
RFP. Instead, public confidence has weakened and scrutiny has intensified due to the known 
involvement of at least two heavily-conflicted individuals in the single source decision and the 
issuance of an RFP so severely restrictive of competition that even large, established cloud 
computing companies cannot compete for the contract award. 3 


1 2018 Federal Cloud Computing Strategy, https://cloud.cio.gov/ (last visited 12/6/18). 

2 The press has noted the inconsistencies between information learned as part of the bid protest 
process and prior DoD representations to the public and Congress. Jared Serbu, Winner take 
most? DoD intends to move majority of applications to JEDI, Federal News Network (Nov. 26, 
2018), https://federalnewsnetwork.com/defense-news/2018/11 /winner-take-most-dod-intends-to- 
move-majority-of-applications-to-jedi/ (last visited 12/6/18) (noting contradictions between DoD 
prior statements that JEDI Cloud contract will only satisfy 20% of DoD's cloud computing needs 
and DoD statements revealed in Government Accountability Office ("GAO") protest decision 
that DoD intends to migrate up to 80% of its current IT systems to the JEDI Cloud). 

3 Frank Konkel, The Pentagon's war cloud procurement could face more scrutiny, NextGov 
(Oct. 23, 2018), https://www.nextgov.com/media/gbc/docs/pdfs_edit/102318fklng.pdf (last 
visited 12/6/18). 


2 
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4. Gartner, a leading IT marketplace research and advisory service, identifies six 
IaaS providers of scale: Alibaba Cloud, Amazon Web Services ("AWS"), Google, IBM, 
Microsoft, and Oracle. 4 Significantly, Gartner also notes the rapid market change and varying 
strengths of these companies. DoD knew this information; the Agency interviewed Gartner as 
part of its market research. (AR Tab 47a, Nov. 2, 2017 email from Bergin to Ubhi et al. re: 
Cloud Focus Session - Gartner, at 2833.) 5 Yet, the Agency intentionally crafted its RFP pass/fail 
Gate Criteria so that only fat most! two of the six IaaS providers can compete for the contract : 

• Google has declined to bid for the JEDI contract, noting: " we determined that 
there were portions of the contract that were out of scope with our current 
government certifications ." 6 Google also stated: "Had the JEDI contract been 
open to multiple vendors, we would have submitted a compelling solution for 
portions of it.... At a time when new technology is constantly becoming available, 
customers should have the ability to take advantage of that innovation ." 7 

• IBM has protested the JEDI Cloud RFP noting in a public statement that: 
"Certain requirements in the RFP either mirror one vendor's internal processes or 
unnecessarily mandate that certain capabilities be in place by the bid submission 
deadline versus when the work would actually begin. Such rigid requirements 
serve only one purpose: to arbitrarily narrow the field of bidders ." 8 

• Oracle has challenged the JEDI Cloud RFP and its unduly restrictive criteria. 


4 See Magic Quadrant for Cloud Infrastructure as a Service, Worldwide, Gartner (May 23, 
2018), https://www.gartner.com/doc/reprints?id=l-50WJ5CK&ct=180525&st=sb (last visited 
12/6/18). 

5 To support its Complaint allegations, Oracle's counsel has included citations to the protected 
Agency Record that DoD submitted in response to Oracle's prior protest at GAO. Because 
Oracle's counsel expects that DoD will submit the cited documents as part of the Administrative 
Record, Oracle's counsel has not attached the protected documents cited herein. Oracle can 
provide the documents on the Court's request. 

All emphasis of quoted material in this submission is added unless otherwise expressly noted. 

7 Aaron Gregg, Google bows out of Pentagon's $10 billion cloud-computing race. The 
Washington Post (Oct. 9, 2018), https://www.washingtonpost.eom/business/2018/10/09/google- 
bows-out-out-pentagons-billion-cloud-computing-race/?utm_term=.a52ce34abd46 (last visited 
12/6/18). 

8 Sam Gordy, JEDI: Why We're Protesting, IBM (Oct. 10, 2018), https://www.ibm.com/blogs/ 
policy/jedi-protest/ (last visited 12/6/18). 


3 
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• Microsoft has severely criticized the JEDI Cloud procurement, questioning its 
structure and fairness. 9 

• Alibaba (a Chinese-owned company) is ineligible. 

Hundreds of companies attended the industry day; more than sixty companies submitted detailed 
request for information ("RFI") responses identifying extensive, sometimes unique capabilities 
(Contracting Officer's Statement of Facts ("COSF") at 3-4 (| 6)); 10 and no more than two 
companies can even potentially satisfy the RFP Gate Criteria. (AR Tab 25, Acquisition Strategy 
at 500 (explaining that Agency will use a gated evaluation approach to limit the number of 
proposals and avoid protests).) 

5. The Competition In Contracting Act ("CICA") compels full and open competition 
absent an appropriate head of the agency justification and approval ("J&A") to restrict the 
competitive field. See 10 U.S.C. § 2304 (2018) (except as otherwise permitted, "the head of an 
agency in conducting a procurement for property or services-(A) shall obtain full and open 
competition...."); 10 U.S.C. § 2304a(c) (2018) (applying section 2304's competition requirements 
to task and delivery order contracts); 10 U.S.C. § 2305 (requiring DoD solicitations to permit 
"full and open competition"). The Agency did not issue a J&A or otherwise follow the 
procurement statutes and regulations for restricting competition. 

6. The Court must sustain this protest for several reasons. Any other result will 
frustrate Congressional direction, improperly restrict the competitive field, and undermine the 
integrity of the procurement process. 

9 Billy Mitchell, DOD defends its decision to move to commercial cloud with a single award, 
FedScoop (Mar. 8, 2018), https://www.fedscoop.com/dod-pentagon-jedi-cloud-contract-single- 
award/ (last visited 12/6/18). 

10 Because Oracle's counsel expects that DoD will include the parties' GAO filings as part of the 
Administrative Record, Oracle also does not attach the protected GAO filings to this Complaint. 
Oracle can provide the documents on the Court's request. 

4 
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7. First. DoD issued a single IDIQ contract award determination in direct violation 
of the U.S. Code. This is a straight statutory construction issue; it is not a matter of deference or 
national security as claimed by DoD in this streamlined, commercial item cloud computing 
competition. Congress has prohibited the very contract approach DoD has implemented. 

8. As related to large IDIQ contract awards, Congress has set two separate 
requirements, emanating from two different Congresses . The First requires the contracting 
officer to develop acquisition strategies favoring multiple awards to the "maximum extent 
practicable." 10 U.S.C. § 2304(a)(d)(4). The second, which a later Congress enacted when DoD 
continued using single source IDIQ contracts to the detriment of the United States, is a 
prohibition against awarding any IDIQ contract valued at greater than $112 million to a single 
contractor (thereby foregoing task order competition) unless the head of the procuring agency (or 
designee) issues a determination and findings ("D&F") that the award satisfies one of four 
limited statutory exceptions. 10 U.S.C. § 2304a(d)(3) (initial prohibition set at $100 million). 

9. Given its potential $10 billion value, DoD may not lawfully award the anticipated 
JEDI Cloud IDIQ contract to a single awardee unless the appropriate high level official correctly 
determined, in writing, that one of the four statutory exceptions applies. The Under Secretary of 
Defense for Acquisition and Sustainment, Ellen Lord's D&F errantly claims that JEDI Cloud 
contract satisfies the second exception, i.e., the solicited contract purportedly will only permit 
firm fixed price task orders involving "services for which prices are established in the contract 
for the specific tasks to be performed ." (AR Tab 16, D&F at 317.) The D&F states incorrectly 
that offerors will provide commercial catalogs at the time of award "cover[ing] the full potential 
10 years" and will submit a "single, fixed unit price for delivery of that particular cloud service." 
(Id. at 316.) These statements, however, have no resemblance to the cloud services solicited, 


5 
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which exist in a near constant state of change, or the contract that the RFP contemplates. 

10. Indeed, clause H2 will require the awardee to regularly add (as frequently as daily 
or weekly) its new commercial offerings onto the JEDI Cloud at yet undetermined prices, and 
contemplates the awardee working with DoD to develop new classified offerings - none of 
which offerors in the JEDI Cloud competition will specify or price in their proposals. (AR Tab 
35, RFP Am. 2 at 736-37.) Clause H2 pegs new offering prices to the awardee's future 
commercial catalogs - as if this somehow equates to a competition for a base IDIQ contract 
award for services with an " established price " for an RFP-specified " specific task ." 

11. Although cloud computing is new, technology contracting is not. Significantly, 
past agency use and reliance on similar provisions as a substitute for task order competition 
provided the impetus for Congress passing the multiple award preference and single source 
prohibitions in the first place: " Before FASA. many agencies relied on long-term ID/IO and 
umbrella contracts with technology refreshment and price reduction clauses to take advantage of 
falling prices and new technology. Even with these clauses, the government had to negotiate in a 
sole-source environment and was often unable to realize the economies and efficiencies afforded 
bv vigorous competition among vendors in the marketplace. " Best Practices for Multiple Award 
Task And Delivery Order Contracting at 14, https://www.gsa.gov/cdnstatic/BestPractices 
MultipleAward.pdf (last visited 12/6/18). 

12. To borrow from a Bloomberg article questioning the D&F and GAO decision: 

[GAO's denial of Oracle's challenge] raises an important question about the 
government's acquisition of emerging technologies. With cloud computing a 
rapidly evolving field, it's possible that by the end of JEDI's 10-year lifespan, the 
winning vendor will deploy services that haven't yet been invented. How can the 
Pentagon request firm fixed prices on services that don't vet exist? 

Chris Comillie, Five Takeaways from GAO's JEDI decision Denying Oracle, Bloomberg (Nov. 
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30, 2018), https://about.bgov.com/blog/five-takeaways-jedi-decision-oracle/ (last visited 

12/6/18). 

13. Second, having failed against the prohibition on single source IDIQ contracts over 
$112 million, the Court need not reach the question of when the Contracting Officer ("CO") 
satisfied the separate obligation (applicable to all IDIQ contract competitions) to favor a multiple 
award acquisition strategy to the maximum extent practicable . Regardless, the CO's maximum 
practicable analysis fails against the U.S. Code and this Court's precedent. 

14. The CO focuses solely on the purported negatives and costs of task order 
competition and never assesses or tallies the benefits from competition. Moreover, the CO 
presents "cost" of competition numbers that strain credulity, contradict government data, and 
ignore Congress' preferences. 

15. A concoction of ipse dixit assertions, unsupported inputs, admitted inaccurate 
assumptions, and disregard for the benefits of competition yields plainly arbitrary statements 
such as: "a single award prevents 770 years' worth of delays to warfighters." (Agency 
Memorandum of Law ("MOL") at 37.) The suggestion that Congressionally-mandated task 
order competitions will prevent the warfighter from receiving the benefits of cloud computing 
before 2788 or even will require 770 years of added effort lacks reason. See WinStar Comm'ncs, 
Inc. v. United States , 41 Fed. Cl. 748, 758 (1998) (rejecting propriety of single award approach 
and criticizing arbitrary assertions regarding the costs of a single source award versus a multiple 
source award: "Obviously, it is impossible to conclude that a single award will provide more 
favorable terms and conditions, including pricing ... without first considering the terms and 
conditions which would result from multiple awards."). 

16. Indeed, Congress, after receiving these very explanations from DoD, directed 
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DoD, with specific reference to the JEDI Cloud procurement, to "defin[e] opportunities for 
multiple cloud service providers." H.R. 6157, § 8137 (Sept. 27, 2018). Given that the single 
award approach which DoD seeks to defend contradicts Congress' direction regarding the JEDI 
Cloud, no basis exists to find DoD's acquisition strategy reasonable. 

17. Third, three of the RFP's seven Gate Criteria that each offeror must pass in order 
to compete for the contract exceed DoD's needs and violate CICA to the significant competitive 
prejudice of Oracle. (AR Tab 35, RFP Am. 2 at 801-03.) DoD's record shows that the Agency 
crafted several gate criteria to reduce competition and avoid task order protests, rather than 
develop the requirements to address DoD's actual minimum needs. 

18. Gate Criterion 1.2 mandates, at the time of proposal submission, three existing, 
physical data centers separated by at least 150 miles, each supporting at least one IaaS and one 
PaaS offering authorized through the Federal Risk and Authorization Management Program 
("FedRAMP"). At most, two offerors can meet this requirement. 

19. The FedRAMP office (consistent with the U.S. Code and procurement law) 
prohibits procuring agencies from requiring FedRAMP authorization as a prerequisite to bid. 
" Federal agencies cannot require TCloud Service Providers ("CSPs")1 to be FedRAMP authorized 
as part of their RFP but can state that a CSP needs to be FedRAMP authorized once federal data 
is placed in the system. " 11 Rather, such a requirement would trigger 10 U.S.C. § 2319's 
"qualification requirement" restrictions and require DoD to take numerous steps prior to using 
the qualification - none of which DoD has undertaken here. W.G. Yates & Sons Constr. Co. Inc. 
v. Caldera, 192 F.3d 987 (Fed. Cir. 1999) (declaring qualification requirement invalid where 
agency violated statutory requirements). 

11 FedRAMP Tips & Cues Compilation 2015-2017 (Jan. 2018) at 7, https://www.fedramp.gov/ 
assets/resources/documents/FedRAMP_Tips_and_Cues.pdf (last visited 12/6/18). 

8 
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20. Despite extensive argument in Oracle's submissions, GAO's decision does not 
mention FedRAMP's prohibition or the statutory restriction on such qualification requirements, 
deferring instead to DoD's national security claims. See Oracle Am., Inc., B-416657 et. al., Nov. 
14, 2018, 2018 WL 6040648. But Congress specifically targeted the qualification prohibition on 
DoD and did not exempt procurements that might relate to national security. 

21. Even if such qualification requirements are appropriate (which they are not), the 
U.S. Code requires that DoD permit offerors to demonstrate the ability to meet the requirement 
prior to award. 10 U.S.C. § 2319(c)(3). Gate Criterion 1.2 violates this provision as well. 

22. The JEDI Cloud Cyber Security requirements do not require the awardee's Cloud 
offerings be FedRAMP authorized. (Van Name Test, at 100:5-14 ("[W]e are not requiring, as 
part of the JEDI cybersecurity plan, that the winner go through the FedRAMP process before 
DoD uses the final solution"); id. at 101:3-6 ("Q: So if I understand correctly, your cybersecurity 
plan does not require FedRAMP authorization. A: Correct.").) 12 Rather, the RFP and contract 
contemplate that DoD will work with the awardee after award to ensure the proposed offerings 
and data centers comply with the JEDI Cloud Cyber Security Plan outside of the FedRAMP 
process. (Id. at 101:7-103:15; see also AR Tab 5K, CDRL 11 at 156 (instructing contractor to 
"prepare and submit a sufficiently complete security authorization package to demonstrate all 
applicable requirements in the JEDI Cloud Cyber Security plan" 30 days after award).) 

23. Oracle has invested heavily into its Next Generation Government Cloud, has a 
DoD sponsor, and seeks to offer this latest state-of-the-art technology to the JEDI Cloud users. 
Much of this Cloud is built and under review. The remainder will come online and complete the 

12 Because the GAO hearing transcript will form part of the Administrative Record the United 
States will file with this Court, Oracle also has not attached that protected document to this 
filing. Oracle can provide the transcript on the Court's request. 

9 
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FedRAMP process in advance of award. Absent revision to the unduly restrictive Gate Criterion 
1.2, however, Oracle cannot offer its Next Generation Government Cloud to JEDI Cloud users. 

24. Fourth. Gate Criterion 1.1 requires each offeror to demonstrate " for evaluation 
purposes " that the identified JEDI Cloud unclassified usage numbers are less than 50% of the 
Commercial Cloud Offering usage during the months of January-February 2018 as measured 
against three metrics: (i) Network - volume of commercial client traffic in bytes in and out of 
the controlled infrastructure; (ii) Compute - number of physical compute cores in use by 
applications; and (iii) Storage - data in bytes for each online, nearline, and offline. (AR Tab 35, 
RFP Am. 2 at 787.) 

25. Although the Subfactor 1.1 metrics are massive, ill-suited to the purported 
purpose, and intended to block all but the very largest cloud providers from even competing, 
Oracle does not object to the application of such criteria, only the timing of the application. The 
Agency seeks to apply these metrics as of Januarv-Februarv 2018 - nine months before proposal 
submission and fifteen months before the anticipated award . The U.S. Code and case law 
prohibit application of such requirements prior to award, yet here DoD seeks to apply the criteria 
long before even proposal submission. The contemporaneous record provides no explanation for 
measuring these criteria nine months prior to proposal submission. The period selected is 
arbitrary, violates U.S. Code and Federal Acquisition Regulation ("FAR") provisions governing 
solicitation requirements and qualification requirements, and prejudices Oracle. 

26. Fifth. Subfactor 1.6 also does not represent a legitimate minimum need. Gate 
Criterion 1.6 requires demonstration at the time of proposal submission that the offeror has an 
online marketplace of third-party platform and software offerings that JEDI Cloud users can use 
to purchase and provision software. DoD lacks authority to procure such a marketplace. 
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27. This Court just weeks ago declared the attempt by the U.S. Department of 
Veterans Affairs to set up such a vendor overseen marketplace a plain violation of CICA. 
Electra-Med Corp. v. U.S., 140 Fed. Cl. 94, 104 (2018) ("By outsourcing the selection of 
suppliers to the PVs [Prime Vendors] entirely, the government has avoided the multitude of legal 
and regulatory requirements appurtenant to a federal procurement.... CICA has been violated 
unless the J&A provides legal cover for the lack of competition [to put products in the 
marketplace].") Congress only recently gave the General Services Administration ("GSA") 
permission to test such an approach and required the use of multiple contractors. See Pub. L. 
115-91, § 846(a), Dec. 12,2017, 131 Stat. 1483. 

28. DoD has not identified any statutory or regulatory authority permitting it to set up 
this online marketplace or how such a vendor-run marketplace complies with CICA. Instead, 
DoD contends that Oracle (which has a marketplace for its commercial customers) suffers no 
harm from DoD exercising authority it does not have. GAO (apparently also unable to identify 
any source of authority) adopted the Agency's no prejudice defense. The Federal Circuit, 
however, has established that such illegal solicitation terms cause substantial prejudice as 
offerors have a "definite stake in the solicitation being carried out in accordance with applicable 
laws and regulations." Weeks Marine, Inc. v. U.S., 575 F.3d 1352, 1362-63 (Fed. Cir. 2009). 

29. Sixth, the record produced at GAO evidences material conflicts of interest that 
tainted the procurement without meaningful investigation by the CO and, if unchecked, will 
further subvert the JEDI Cloud procurement moving forward. The FAR mandates that procuring 
agencies "avoid strictly any conflict of interest or even the appearance of a conflict of interest in 
Government-contractor relationships," and that agencies conduct government business in a 
manner above reproach, with complete impartiality. 48 C.F.R. § 3.101-1. Here, the Agency 
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inexplicably failed to prevent, screen for, and investigate adequately the conflicts of interest that 
arise from the involvement of Deap Ubhi and Anthony DeMartino. 

30. The Agency hand-selected Ubhi to serve as the lead JEDI Cloud Product Manager 
("PM"), despite Ubhi's ongoing connections with AWS. Ubhi previously worked at AWS before 
joining the Defense Digital Service ("DDS") in the summer of 2016, and he returned to AWS in 
a leadership position in November 2017, where he remains today. While engaged on the JEDI 
Cloud procurement, Ubhi held discussions with AWS regarding AWS buying one of Ubhi's 
businesses, and had employment discussions with AWS. 

31. Ubhi participated extensively in the JEDI Cloud acquisition, learning about and 
identifying the JEDI Cloud user's needs; what has and has not worked in prior cloud acquisitions; 
developing and advocating for the single award approach : engaging in "highly technical" 
discussions with potential JEDI Cloud competitors; and drafting or discussing the Business Case, 
requirements (metrics), and other acquisition strategy documents, among other things. (See, e.g., 
AR Tab 47c, Sept. 29, 2017 Slack message from Woods to Ubhi at 3105 (" I really need to better 
understand from you TDeap Ubhi! why only one provider makes sense. "1.1 

32. Ubhi had unlimited access to the procurement "google drive," which housed all of 
the JEDI Cloud procurement sensitive information. (See e.g.. Van Name Test, at 137:17-18, 
138:8-16; AR Tab 47a, Sept. 21, 2017 Slack message from Ubhi at 2906 (Ubhi announcing: "If 
anyone has any problems accessing Google Docs, which will be our repository for *everything*, 
please let Jordan, Devon or me know ASAP.").) Ubhi personally met with numerous user 
agencies regarding their particular needs. (See, e.g., AR Tab 47c, Oct. 6, 2017 Slack messages 
from Ubhi at 3168-69 (regarding an internal meeting with the Navy's Space and Naval Warfare 
Systems Center ("SPAWAR"): " She's schooling us on the tactical edge ").) 
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33. Ubhi also met with numerous potential JEDI Cloud competitors regarding their 
proprietary capabilities - including Microsoft, Google, and others. (AR Tab 47a, Nov. 10, 2017 
Email from Strausbaugh to Kasper and Ubhi at 2783 (Microsoft thanking Ubhi for "our meeting 
a couple of weeks ago at the Pentagon"); AR Tab 47a, Oct. 25, 2017 Email from Ubhi to Black 
at 2896 (regarding JEDI meeting and advising Google to "expect our conversation tomorrow to 
be highly technical"); AR Tab 47c, Sept. 28, 2017 Slack message from Ubhi at 3098 ("All 
industry contacts that have been funneled to me have received a response. I will treat them all 
equally (unless they are stupid - stupidity gets no equality).") 

34. Ubhi's Slack messages (internal texts) shared with the core DDS team are riddled 
with inappropriate comments about competitors, DoD personnel, and others, raising significant 
questions about the propriety of this procurement. (AR Tab 47c, Oct. 5, 2017 Slack message 
from Ubhi at 3156-8 (Ubhi attacking one of the Under Secretary's deputies (Jane Rathbun) after 
she referred favorably to Microsoft: "Role playing: I'm Jane R.\holy shit, SaaS is the holy grail, 
they [Microsoft] do it ALL for us!" "She compared Office 365 with AWS." "We've got some real 
dum dums in here, their names usually begin with J..."); id., Sept. 29, 2017 Slack message from 
Ubhi at 3108 (attacking SAIC "nooooooo!" "stuckouttongueclosedeyes"); id., Oct. 4, 2017 
Slack message from Ubhi at 3148 (Ubhi: as related to SalesForce, which owns Heroku, "we 
might need to entertain" "sigh," then undermining Heroku).) 

35. Ubhi attacked anyone who took multi-cloud positions or advocated non-AWS 
solutions. (AR Tab 47a, Oct. 25, 2017 Emails from Ubhi to Kasper and Woods at 2877 ("waste 
of time" "what.the.f—.is.this." (dashes added), Ubhi responding to IT-AAC presenting summary 
of dozens of industry, GAO, and other cloud studies).) Perhaps due to unfamiliarity with FAR 
3.101-1's mandate that "Government business shall be conducted in a manner above reproach" 
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and with an "impeccable standard of conduct," the core DDS team that led this procurement with 
Ubhi neither challenged nor rebuked Ubhi's conduct. 48 C.F.R. § 3.101-1. 

36. Ubhi's conduct gives rise to two separate conflict issues: (i) did AWS and Ubhi 
(as the acquisition's lead PM) create an appearance of impropriety or bias the procurement; and 
(ii) has AWS created a further conflict of interest by engaging in employment discussions and re¬ 
hiring Ubhi during the procurement. The CO's assessment of these conflicts spans less than one 
page. (AR Tab 33, Integrity Mem.) The investigation did not involve an interview of Ubhi, 
failed to identify when or how the Ubhi-AWS business negotiations began, disregarded the 
documents Ubhi accessed, downplayed and mischaracterized Ubhi's acquisition role, and entirely 
ignored Ubhi's subsequent AWS employment. Stated otherwise, the CO's investigation of 
conflicts created by Ubhi's business dealings with AWS is incomplete and the CO's investigation 
of the conflict arising from his re-employment by AWS does not exist. 

37. Seventh , adding to the JEDI Cloud conflict problems, Anthony DeMartino, the 
Chief of Staff for the Deputy Secretary of Defense and a former AWS consultant, participated 
personally and substantially in the acquisition by, among other things, advocating procurement 
positions, including single source; participating substantively in JEDI Cloud meetings and 
briefings; and editing official communications and other procurement-related documents. 
DeMartino's JEDI Cloud procurement participation violated conflict restrictions of the U.S. 
Code, the Code of Federal Regulations, and his Executive Order ethics pledge. 

38. The DoD Standard of Conduct Office ("SOCO") specifically warned DeMartino 
against participating in any matter involving AWS without advance SOCO approval. (AR Tab 
51, April 24, 2017 email from Irvine to DeMartino at 24341.) DeMartino ignored SOCO and the 
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regulations to which he was subject, electing instead to participate in the JEDI Cloud acquisition 
for over six months prior to raising the matter with SOCO. 

39. When DeMartino finally sought SOCO's approval in April 2018 (apparently due 
to press contacts and Freedom of Information Act ("FOIA") requests), SOCO directed 
DeMartino to separate from the JEDI Cloud procurement. (Supp. COSF at 6 (f 13).) But the 
procurement damage from DeMartino's months of involvement already had occurred. 

40. The CO's DeMartino investigation also spans less than one page, lacks critical 
information, and contains errant information. (AR Tab 33, Integrity Mem. at 681.) 

II. PARTIES 

41. Plaintiff Oracle America, Inc., a leading technology provider, delivers enterprise 
cloud computing services globally, http://www.oracle.com/us/corporate/oracle-fact-sheet-0792 
19.pdf (last visited 12/6/18). More than 500 government organizations use the leading edge 
technology, flexibility, and cost savings provided by the Oracle Cloud, https://www.oracle.com/ 
industries/public-sector/index.html (last visited 12/6/18). 

42. The DoD Washington Headquarters Services provides administrative support 
services to the Secretary of Defense and various DoD agencies, http://www.whs.mil/our- 
organization (last visited 12/6/18). 

III. JURISDICTION AND VENUE 

43. The Court has jurisdiction over this action pursuant to 28 U.S.C. § 1491(b). See 
Sys. Application & Techs., Inc. v. U.S., 691 F.3d 1374, 1380-81 (Fed. Cir. 2012) (affirming 
§ 1491(b)'s "broad grant of jurisdiction"); Res. Conservation Grp., LLC v. U.S., 597 F.3d 1238, 
1244 (Fed. Cir. 2010) (explaining that "procurement or proposed procurement" as used in 
§ 1491(b) "includes all stages of the process of acquiring goods or services") (citation omitted). 
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44. Venue is proper in this Court pursuant to 28 U.S.C. § 1491(b). 

IV. STANDING 

45. Oracle is an interested party with standing to bring this protest. See 28 U.S.C. 
§ 1491(b)(1). Oracle timely submitted a proposal in response to the RFP. Oracle also expects to 
compete under any revised solicitation the Agency issues. 

46. Oracle has a direct economic interest in the RFP because the alleged violations of 
law and arbitrary actions cause Oracle "non-trivial competitive injury," which the Court can 
redress by judicial relief. Weeks Marine, Inc. v. U.S., 575 F.3d 1352, 1362-63 (Fed. Cir. 2009). 

47. Specifically, the single award decision, unduly restrictive RFP terms, and 
conflicts of interest all undermine Oracle's ability to compete fairly under the RFP, an injury this 
Court can remedy by declaring the challenged RFP provisions improper and enjoining the 
Agency from making award under the RFP until the Agency amends the RFP and adequately 
investigates and addresses the conflicts of interest. See Palantir Techs. Inc. v. U.S., 128 Fed. Cl. 
21, 30-38 (2016) (protester had standing to raise pre-award protest challenging Army failure to 
issue solicitation on a commercial item basis). 

V. TIMELINESS 

48. Oracle timely filed its protest challenging the solicitation terms and conflicts of 
interest at GAO prior to the proposal submission deadline. See Blue & Gold Fleet, L.P. v. U.S., 
492 F.3d 1308, 1313 (Fed. Cir. 2007); 4 C.F.R. § 21.2(a)(1). The proposal submission deadline 
lapsed during Oracle's pre-award protest at GAO, and Oracle submitted a timely proposal. 

49. Oracle timely files this protest at this Court following GAO's denial of Oracle's 
protest. DGR Assocs., Inc. v. U.S., 94 Fed. Cl. 189, 202-03 (2010) (protester which timely 
pursued GAO protest may file further protest at Court notwithstanding proposal submission date 
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passing); see also DGR Assocs., Inc. v. U.S., 690 F.3d 1335, 1343 (Fed. Cir. 2012) (observing 

l 

that Blue & Gold requires an objection prior to award, and stating: "The trial court aptly noted 
that reading more into the statement such as the Government was doing would be inconsistent 
with the principle of exhaustion of administrative remedies.").) 

VI. FACTUAL ALLEGATIONS 

A. The Genesis Of DoD's JEDI Cloud Initiative And Conflicted Participants 

50. According to the JEDI Cloud Acquisition Strategy, DoD's IT environment is 
"highly decentralized with thousands of networks and data centers and more than 500 cloud 
efforts ." (AR Tab 25, Acquisition Strategy at 467.) "DoD operates one of the most complex 
technical missions in the world and spends approximately $45 billion per year on IT." (Id.) 

51. In August 2017, the Secretary of Defense and members of the Defense Innovation 
Board visited AWS' Seattle, Washington facility "to understand the cloud market capability." 
(AR Tab 33, Integrity Mem. at 682.) 

52. In September 2017, the Deputy Secretary of Defense established a Cloud 
Executive Steering Group ("CESG"), chaired by the Honorable Ellen Lord, to "devise and 
oversee the execution of a strategy to accelerate the adoption of cloud architectures and cloud 
services, focusing on commercial services." (Accelerating Enterprise Cloud Production Mem. at 
1, Ex. 2 to Consol. Protest.) Phase I of that initiative included a tailored acquisition process to 
acquire a modem enterprise cloud services solution that can support unclassified, secret, and top 
secret information. (Id. at 2.) 

53. The Deputy Secretary of Defense tasked DDS, a relatively new unit designed to 
transform how DoD procures technology, to lead the effort. (Id.) 
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54. Despite the magnitude and importance of the procurement, DDS (which 
intentionally hires personnel from the private sector for limited terms) had no formal conflict of 
interest screening process. Rather than exclude individuals with financial and other connections 
to potential competitors, DDS hand selected Ubhi, a DDS Product Director, as the lead PM in 
September 2017. (AR Tab 47a, Oct. 16, 2017 Email from Woods to Fletcher at 2809; Van Name 
Test, at 34:10-36:7; id at 113:10-12, 135:11-22.) 

55. Prior to joining DDS, AWS employed Ubhi. (Linkedln Profile, Ex. 1 to Consol. 
Protest.) During Ubhi's employment with DDS, AWS remained in contact with Ubhi and 
apparently actively negotiated to purchase a business from Ubhi. (AR Tab 33, Integrity Mem. at 
682.) Ubhi returned to AWS in November 2017. (Linkedln Profile, Ex. 1 to Consol. Protest.) 

56. Ubhi was a member of the four person DDS team leading the JEDI Cloud 
acquisition. (AR Tab 47a, Oct. 16, 2017 Email from Woods to Fletcher at 2809.) Among other 
critical procurement aspects, Ubhi drove the single award decision: " Deap has a specific wav he 
wants to tackle this Tone versus multiple providers! and will be attending in person for this 
purpose. " (AR Tab 47c, Oct. 9, 2017 Slack message from Woods to Griffith at 3172 (regarding 
meeting with CESG); see also id.. Sept. 29, 2017 Slack message from Woods to Ubhi at 3105.) 

57. Ubhi attended CESG meetings, including a critical meeting in October 2017 
between CESG and DoD's cost and pricing team regarding a single or multiple award approach. 
(Van Name Test, at 49:17-18, 233:3-9; AR Tab 47c, Oct. 9, 2017 Slack messages between Ubhi, 
Woods, and Griffith at 3177.) Ubhi advocated "robustly" for the single award approach 
(countering multiple award advocates) at the meeting. (CO Test, at 347:7-14.) 

58. Ubhi also participated substantially in preparing the "Problem Statement" for 
DoD leadership that "explains the problem we are solving with this initiative," including "why 
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can't we solve the problem with multiple clouds," and "why is only one cloud a truly necessary 
requirement." (See AR Tab 47b, Sept. 15, 2017 Slack message from Woods at 2982 (describing 
Problem Statement objectives); id., Sept. 15, 2017 Slack message from Kasper at 2988 
(confirming Ubhi's involvement in preparing and revising Problem Statement); id. at Sept. 19, 
2017 Slack message between Ubhi and Kasper at 3002 (same).) 

59. Ubhi contributed to the Business Case Analysis (AR Tab 47c, Oct. 10, 2017 Slack 
message from Ubhi at 3198; Van Name Test, at 47:21-48:6 (testifying Ubhi was "involved in 
early conversations about what the format of the business case should be, and what the outline 
might look like."); CO Test, at 177:4-11 (describing how Ubhi became involved in Business 
Case)), a document that describes itself as " sending! as a foundation " for the JEDI Cloud 
procurement. (AR Tab 21, Business Case Analysis at 395.) 

60. Ubhi also participated in developing the acquisition strategy. (AR Tab 47a, Oct. 
20, 2017 Slack message between Merker, Dickson-Kozloski, and Ubhi at 2959 ("good morning 
all i'm looking for any work that has been done so far on the acquisition strategy").) 

61. Ubhi helped identify and define the JEDI Cloud requirements. (See, e.g., id.. 
Sept. 28, 2017 Slack message from Ubhi to Oti at 2937 (addressing technical requirements); id., 
Oct. 24, 2017 Slack message from Van Name to Ubhi at 2960 ("thanks for initiating and for your 
work on the requirements documents").) 

62. Ubhi met with various DoD stakeholders to learn about their cloud-related needs, 
such as the Air Force (AR Tab 47a, Oct. 26-30, 2017 Emails between Ubhi, Boozell, Ellsworth, 
et al. at 2802) and the Navy (see id. at 2825), including SPA WAR (see AR Tab 47b, Sept. 27, 
2017 Slack messages between Ubhi, Mackay, and Griffith at 3061-71; AR Tab 47c, Oct. 6, 2017 
Slack messages from Ubhi at 3168-69 (regarding an internal meeting with SPA WAR), and the 


Case l:18-cv-01880-EGB Document 13 Filed 12/10/18 Page 20 of 97 


Marine Corps. (AR Tab 47c, Sept. 29, 2017 Slack messages between Ubhi, Kasper, and Woods 
at 3110-11; Van Name Test, at 41:11-42:3 (noting that CESG "collectfed] information [on] the 
Department's current usage of cloud services.... Deap was having those conversations").) 

63. Ubhi was responsible for DDS' communications with industry about the 
procurement. (AR Tab 34, Ubhi-AWS Emails at 704 (showing that on October 2, 2017, Ubhi 
advised AWS that he was "running point on all [JEDI] industry touch points").) 

64. Ubhi met with numerous potential competitors for the JEDI Cloud regarding their 
capabilities and approaches - including Microsoft, Google, and others. (AR Tab 47a, Nov. 10, 
2017 Email from Strausbaugh to Kasper and Ubhi at 2783 (Microsoft thanking Ubhi for "our 
meeting a couple of weeks ago at the Pentagon"); AR Tab 47a, Oct. 25, 2017 Email from Ubhi to 
Black at 2896 (regarding JEDI meeting and warning Google to "expect our conversation 
tomorrow to be highly technical").) 

65. These one-on-one meetings with potential Cloud vendors were "highly technical." 
(Van Name Test, at 68:12-69:11 (Ubhi "coordinat[ed] those conversations" for the one-on-one 
vendor meetings with cloud providers, including AWS, Google and Microsoft, and conceding 
the conversations "were highly technical").) The meetings involved questions to each of the 
vendors about their capabilities, including: 

1. What does you hardware architecture look like with regard to cloud services? 

2. [If they don't provide hardware solution ] How does your company interact with 
a deployed cloud solution? Where does it hook in and how? 

3. Talk to us about your approach to information security, specifically with regard 
to minimizing attack vectors and then identifying, mitigating, and containing 
issues. 

4. How does account provisioning or service initiation work with your solution? 

What parts of this are automated versus requiring administrator interaction? And 
what about service termination? 
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5. How would you handle an installation at the edge of connectivity, including 
service initiation and eventual syncing? 

6. Talk to us about moving data and services across network boundaries, both as it 
applies to peering internally and across physical networks. 

7. What are the general service level expectations of your solution? When there is 
an outage, what is the process for both communication and getting back up? 

What is the process for updating both software and hardware? We're interested in 
both software and hardware issues and solutions. 

8. What is your biggest weakness, and how are you working to improve in that 
area? 

(AR Tab 20, Market Research Report at 384-85.) 

66. As the "lead PM" on the acquisition, Ubhi managed untold amounts of nonpublic 
and acquisition sensitive JEDI Cloud-related information based on his access to the acquisition's 
Google drive. Ubhi was the "owner" of that drive, having "administrative privileges" to the 
drive. (See, e.g, Van Name Test, at 137:17-18, 138:8-16; AR Tab 47b, Sept. 15, 2017 Slack 
message between Ubhi and Kasper at 2979; AR Tab 47a, Sept. 21, 2017 Slack message from 
Ubhi at 2906; AR Tab 47b, Sept. 15, 2017 Slack message from Kasper at 2980 (describing an 
"an INTERNAL DDS folder for things on this [DoD Cloud] topic we don't want to share ... 
[with a less exclusive group]."); id.. Sept. 20, 2017 Slack message from Ubhi at 3011-13, 3021.) 

67. Ubhi's access to the Google drive also provided him access to JEDI Cloud 
information shared with DDS by the offices of the DoD Chief Information Officer ("CIO") and 
the Under Secretary, which "agreed to data dump everything into Google Folder and use Slack." 
(See AR Tab 47b, Sept. 15, 2017 Text from Woods at 2982.) 

68. Ubhi also received acquisition sensitive information through emails and meetings. 
(AR Tab 47e, Oct. 27, 2017 Email from Kasper to Berrios at 3311-12 (noting attached 
" documents are acquisition sensitive and should not be disclosed to any contractors .").) 


Case l:18-cv-01880-EGB Document 13 Filed 12/10/18 Page 22 of 97 


69. Ubhi also attacked other multi-award DoD cloud procurement efforts. For 
instance, as related to a recent Air Force $1B multi-cloud contract Ubhi chided: "That Air Force 
contract makes me weep" "[a]nd some wonder why cloud adoption has not taken off in DoD...." 
(AR Tab 47a, Sept. 22,2017 Slack message from Ubhi at 2909-10.) 

70. DoD also involved another conflicted individual - Anthony DeMartino - in the 
JEDI Cloud procurement from its earliest stages. 

71. DeMartino served as a consultant for AWS through January 2017, when he 
entered government service as Deputy Chief of Staff for the Office of the Secretary of Defense, 
and in March 2017 transitioned to serve as the Chief of Staff for the Deputy Secretary of 
Defense. (AR Tab 33, Integrity Mem. at 681.) DeMartino apparently has declared income from 
AWS through August 2017 - the same month in which DeMartino apparently helped arrange for 
Secretary Mattis to visit AWS. a visit which led to the single source JEDI Cloud initiative . 13 

72. Due to DeMartino's financial ties with AWS, DeMartino received an ethics letter 

from DoD's SOCO in A pril 2017. warning DeMartino not to work on matters involving AWS: 

This email is to alert you to and assist you in avoiding potential conflicts of 
interest between your duties as a Government official and your actual or imputed 
financial interests and affiliations... In this instance, you may have a regulatory 
prohibition under 5 C.F.R. §2635.502.... In particular, Amazon, Palantir and 
Bloomberg do business with DoD, and therefore, you should be vigilant and 
consult with our office before participating in any matters involving these entities 
until the one year period has expired. 

(AR Tab 51, April 24, 2017 Email from Irvine to DeMartino at 24341.) 

73. SOCO's written direction to DeMartino, months before the JEDI Cloud 


13 Pete Sweeney, Amazon Pentagon ties may receive greater scrutiny , Reuters (Aug. 16, 2018), 
https://www.reuters.com/article/uk-usa-pentagon-breakingviews/breakingviews-amazon-pentago 
n-ties-may-receive-greater-scrutiny-idUSKBNILlOAS (last visited 12/6/18) ("Both Donnelly 
and DeMartino declared income from Amazon on ethics disclosures, and were working for 
Mattis when he visited Bezos in August 2017."). 
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acquisition began, made clear that the standards of ethical conduct for employees of the 
executive branch applied to DeMartino. For appointees (like DeMartino), the President's ethics 
pledge extends the regulatory prohibition to two years. Exec. Order No. 13770, 82 Fed. Reg. 
9333 (Jan. 28,2017). 

74. Pursuant to regulations and the ethics pledge, DeMartino should not have 
participated in matters involving AWS until at least January 2019. 

75. But DeMartino ignored SOCO's written direction. DeMartino participated 
personally and substantially in the JEDI Cloud procurement from its inception and only later - 
after DoD received FOIA requests about his JEDI Cloud involvement - did DeMartino consult 
with SOCO. In April 2018, SOCO instructed DeMartino to recuse himself from the acquisition. 
(Supp. COSF at 6 (113).) 

76. DeMartino served as the Chief of Staff for the organization driving DoD's cloud 
strategy, obtained briefings on the procurement for the Secretary of Defense and Deputy 
Secretary, directed JEDI Cloud activities, and participated in JEDI Cloud strategy meetings. 
(AR Tab 51, Nov. 10, 2017 Email from DeMartino to Sweeney at 24386 ("DSD is driving the 
Cloud initiative"); see CO Test, at 281:21-282:18; AR Tab 47a, Sept. 27, 2017 Slack message 
from Woods at 2922 ("Chris and I are meeting with Tony DeMartino at 3 PM for 15 minutes. 
Asks will be: 1) email C2S ... 2) article update (they already know); and 3) DSD meeting 
cadence and what he wants on Nov 15th."); Van Name Test, at 146:3-20.) 

77. DeMartino received acquisition sensitive information related to the JEDI Cloud 
procurement. For example, in response to a DoD leadership request for the "draft RFI," "rough 
acquisition strategy," "timeline of acquisition activities," and "the state of the discussion around 
single vs multiple vendors," DDS official Jordan Kasper copied DeMartino on an October 27, 
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2017 email that contained "a two-pager update on the DoD Cloud efforts from the CESG along 
with the draft RFI" that Kasper expressly noted "are acquisition sensitive and should not be 
disclosed to any contractors." (AR Tab 47e, Oct. 27, 2017 Email from Kasper at 3311-12.) 

78. DeMartino edited the Secretary of Defense's JEDI Cloud Briefing. (AR Tab 51, 
Apr. 2, 2018 Email from DeMartino to Mooney at 24364; id. at 24362-63 (document with 
DeMartino comments).) 

79. DeMartino directed efforts and strategized to get approval for the single source 
approach: "I would nuance this with the language about single 2 year award and that there are 
going to [sic] OPPORTUNITIES for other companies to compete for other awards later in the 
lifecycle." (AR Tab 51 at 24362-63 (document with DeMartino comments).) DeMartino also 
requested that DoD's Cost Assessment and Program Evaluation ("CAPE") office provide 
information regarding the number of DoD clouds, the number of data centers, the projected 
savings from the single source acquisition approach, etc. (Id.) 

80. In addition, DeMartino participated in JEDI Cloud meetings related to the 
Acquisition Strategy, Security Strategy, Business Case, and single or multiple award approach. 
(AR Tab 51, Nov. 10, 2017 Email from DeMartino to Lord, Daigle, and Lynch at 24347.) 
DeMartino not only tasked others with action items related to these matters, but the "DSD [] 
tasked Tony DeMartino to review the inputs" provided on each of these topics. (Id., Nov. 15, 
2017 Email from Folliard to Saunders at 24347 ("I've confirmed with the leadership: intent is 
that there will be answers to the RFIs below during the next Cloud meeting with DSD. DSD has 
tasked Tony DeMartino to review the inputs prior to scheduling the meeting.").) 

81. DeMartino communicated with the CIA to assist DDS with marketing research 
efforts and requested "any and all support necessary ... in service of our mission to get the DoD 
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into the cloud." (AR Tab 51, Sept. 27, 2017 Email from Lynch (DDS) to DeMartino et al. at 
24324 ("We've just come off a visit to the C2S facility, and met some helpful, competent folks 
that have been through the migration journey to 'The Cloud'.... I am asking you direct the powers 
that be in the CIA to provide any and all support necessary to the CESG in service of our 
mission".); id., Oct. 2, 2017 Email from DeMartino to Lynch and Woods at 24325 
("Chris/Sharon so I sent the note on JWICS and the Chief to the Deputy at the Agency AND 
their tech guy both called me within the hour").) 

82. DeMartino provided input regarding the industry day briefing. (Id., Feb. 14, 2018 
Email from DeMartino to Woods and Daigle at 24398, 24400.) 

83. DeMartino also coordinated and provided input into the press strategy for the 
JEDI Cloud acquisition. (AR Tab 47f, Oct. 25, 2017 Email from Gleischman to Woods, 
DeMartino, et al. at 3827 ("Tony, I know you were making edits this morning - can you share 
what you have with Chris...."); id., Oct. 26, 2017 Email from Woods to DeMartino, et al. at 3876 
("Tony and Fran, Please see revised version attached. What do you think?"); AR Tab 47e, Oct. 
25, 2017 Email from DeMartino to Woods at 3315 ("Sharon - I've read through it and have some 
thoughts on how to restructure").) 

84. DeMartino also engaged in direct communications with AWS regarding the JEDI 
Cloud acquisition. See JEDI: Emails Between AWS and DoD Officials Reveal Questionable 
Judgment, Ethics Experts Say, Capital Forum Vol. 6 dated August 17, 2018 ("Emails between 
top Amazon Web Services executives and Tony DeMartino, a former senior U.S. Department of 
Defense official who once consulted for AWS, risk creating the appearance of a conflict of 
interest..."); see also AR Tab 51, Jan. 25,2018 Email from Chronis to DeMartino at 24425. 
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B. Market Research And Acquisition Strategy For The JEDI Cloud 

85. In the fall of 2017, DDS submitted a "cloud brief' to the Joint Requirements 
Oversight Council ("JROC") which specified DoD's cloud needs ("capabilities and 
characteristics") and provided guidance on the cloud transition. (AR Tab 17, JROC at 317, 319- 
20; AR Tab 51, Dec. 22, 2017 Email from Lynch to Donnelly, DeMartino, and DuFrayne at 
24365 (indicating that DDS received JROCM approval in a matter of months).) 

86. On or about October 30, 2017, DDS issued an RFI to industry seeking input on 
the JEDI Cloud acquisition. (AR Tab 20, Market Research Report at 3664; 387-90.) DDS 
received sixty-four discrete RFI responses. (AR Tab 23, Acquisition Plan at 433-434.) 

87. In or about March 2018, DoD prepared a report summarizing findings based on 
the RFI responses received. (AR Tab 20.) According to the report, "multiple sources are 
capable of satisfying DoD's requirements for JEDI Cloud" and "commercial cloud services 
customarily provided in the commercial marketplace are available to meet a majority of DoD's 
needs." (Id. at 362.) DoD, however, identified the tactical edge requirements as a notable 
exception. (Id. ) The report concluded, among other things: 

• Only a few companies have the existing infrastructure - in both scale and 
modernity of processes - to support DoD mission requirements, worldwide. 

• Operating in disconnected environments is commercially available to a 
degree, but still an evolving capability. 

• Machine Learning and Artificial Intelligence systems are commercially 
available and continue to evolve at a rapid pace, but are still evolving and 
not a "silver bullet" for data analytics. 

(Id at 365.) 

88. Many respondents indicated that the FedRAMP accreditation process "extremely 
limited" the commercial offerings available to DoD. (Id. at 370.) 
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89. Additionally, a "majority of industry recommended multiple awards in order to 
prevent cost prohibitive vendor lock-in (i.e., it becomes too costly to move data out of the single 
award contractor cloud), and to enable DoD to use different providers to meet specific 
requirements." (Id. at 382.) 

C. The JEDI Single Source Contracting Officer's Memorandum And The 
Under Secretary's D&F 

90. By March 2018. the Agency had publicly announced its JEDI single award 
determination. (AR Tab 18, JEDI Industry Day Slides at 349.) Despite the U.S. Code and FAR 
requirements, neither the CO nor the Under Secretary had made the required findings. 

91. On July 17, 2018, the CO signed a memorandum outlining the rationale for using 
a single award IDIQ contract. (AR Tab 24, Single-Award Mem.) 

92. The CO determined that DoD could not use a multiple award approach for the 
JEDI Cloud acquisition because (i) based on the CO's knowledge of the market, more favorable 
terms and conditions, including pricing will result from a single award competition; (ii) the 
expected cost of administering multiple contracts outweighs the benefits of making multiple 
awards; and (iii) multiple awards are not in the government's best interest. (Id. at 451.) 

93. The CO, however, arbitrarily inflated the costs of IDIQ task order competitions 
and completely disregarded the benefits of task order competition. (Id. at 454.) For instance, a 
2013 study conducted for GSA revealed that the time to award a task order was on average 119 
to 168 hours . Streamlining Task and Delivery Order Solicitations under MA/IDIQ Contracts at 
2, https://interact.gsa.gov/sites/default/files/ASI%20Advisory%20on%20Streamlining%20Final 
%206.9-2016.pdf (last visited 12/6/18). The CO, however, assumed 1.688 hours for each JEDI 
task order competition - an unexplained 1318% increase . (AR Tab 24, Single-Award Mem. at 

454.) The CO asserted no benefits would result from competition. 
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94. On July 19, 2018, the Under Secretary signed a brief single source award D&F. 
(ARTab 16, D&F.) 

95. The D&F generally describes the procurement and its duration. (Id. at 315-16.) 
The fifth paragraph errantly states: "The CLINS for cloud offerings (i.e., IaaS, PaaS, and Cloud 
Support Package) will be priced by catalogs resulting from full and open competition, thus 
enabling competitive forces to drive all aspects of the FFP pricing." (Id. at 316.) Contradicting 
the fixed price assertion, the D&F discusses RFP clauses H2 and H3, which address, 
respectively, price reduction triggers and adding new services onto the contract. (Id. at 316-17.) 

96. The determination concludes: "Based on the above findings, I hereby determine, 
pursuant to 10 U.S.C. § 2304a(d)(3)(B)(ii) that the ID/IQ contract for JEDI Cloud will provide 
only for FFP task orders for services which prices are established in the contract for the specific 
tasks to be performed." (Id.) 

D. The Solicitation 

97. DoD issued the original JEDI Cloud RFP on July 26, 2018, and amended the RFP 
on two occasions during the pendency of Oracle's pre-award protest. (AR Tab 1, Original RFP; 
AR Tab 26, RFP Am. 1, and AR Tab 35, RFP Am. 2.) The RFP solicits a JEDI Cloud for use by 
DoD and other entities involved in DoD business. (AR Tab 35, RFP Am. 2.) 

98. The RFP indicates DOD's intent to conduct the procurement under the 
streamlined commercial item provisions of FAR 12.6. (Id. at 714.) 

99. The RFP provides for DoD to award the JEDI Cloud IDIQ contract, with a 
potential ten year performance period, to a single, best value offeror (id. at 726, 730), and sets 
the maximum contract limit at $10 billion and the minimum guaranteed amount at $1 million. 
(Id. at 726.) 
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100. The RFP contemplates DoD awarding two task orders concurrently with the base 
contract award. {Id. at 778.) 

101. Task Order 1 relates to CLIN 007, and sets up the Cloud Computing Program 
Office Program Management Support. (AR Tab 9, PWS for Task Order 1.) 

102. Task Order 2 obligates to the contract the difference between the guaranteed 
minimum of $1 million and the price of Task Order 1. (AR Tab 10, PWS for Task Order 2.) 

103. The RFP utilizes a four-step evaluation. (AR Tab 35, RFP Am. 2 at 801.) 

104. In Step 1, the RFP directs DoD to evaluate offerors against several "Go/No Go" 
Gate Criteria, discussed in detail below. {See id.) 

105. In Step 2, the RFP requires DoD to evaluate each offeror's proposed technical 
solutions provided that the offeror successfully passes the Gate Criteria. {Id. at 801-02.) 

106. The RFP lists the non-price evaluation factors in descending order of importance: 

Factor 2 - Logical Isolation and Secure Data Transfer 

Factor 3 - Tactical Edge 

Factor 4 - Information Security and Access Controls 

Factor 5 - Applications and Data Hosting and Portability 

Factor 6 - Management and TO 001 

Factor 7 - Small Business Approach 

Factor 8 - Demonstration 

{Id. at 801.) These factors, when combined, have more importance than Factor 9 - Price. {Id.) 

107. The RFP envisions DoD evaluating Price by calculating the Total Evaluated Price 
and reviewing the Task Order 1 price for reasonableness and completeness. {Id. at 807-08.) 

108. Based on the Step 2 evaluation, DoD will determine a competitive range of not 
more than four offerors. {Id. at 778, 801.) 

109. In Step 3, each competitive range offerors will propose a Small Business 
Participation Approach (Factor 7), demonstrate the technical solutions proposed for each Price 
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Scenario (Factor 8), and engage in discussions (if DoD initiates discussions). (Id. at 801.) 

110. DoD then will evaluate the competitive range offerors against the Factor 7 and 
Factor 8 criteria, and eliminate from the competitive range any offerors rated marginal or lower 
for technical capability or high risk. (Id. at 801-02.) 

111. In Step 4 (the final step), DoD will invite remaining offerors to submit a final 
proposal revision and evaluate the final proposals against all criteria. (Id. at 802.) 

1. The RFP Scope of Work and Pricing Provisions 

112. The Statement of Objectives ("SOO") evidences an expansive scope for the JEDI 
Cloud contract. The JEDI Cloud contractor will provide IaaS and PaaS offerings, in both 
unclassified and classified environments, to support DoD business and mission operations from 
the homeland to the tactical edge, including disconnect and austere environments, and closed 
loop networks. (AR Tab 27, Amended SOO at 604.) The RFP defines the tactical edge to 
include "[environments covering the full range of military operations...." (AR Tab 29, 
Amended JEDI Cloud Definitions at 648.) 

113. Users will include DoD entities and others performing "DoD business and 
mission operations," including the U.S. Coast Guard, the Intelligence Community, allies, and 
Federal contractors. (AR Tab 27, Amended SOO at 603.) 

114. As related to cyber security, the CSP must meet: (i) the Cyber Security Plan 
security requirements for the unclassified services within 30 days of contract award; (ii) the 
Secret-level security requirements within 180 days of contract award; and (iii) the security 
requirements for all other classified services including Top Secret, SCI, and SAP within 270 
days of contract award. (AR Tab 27, Amended SOO at 606; see also RFP Cover Letter at 1, 
https://www.fbo.gov/index?s=opportunity&mode=form&id=3860a4f4fe9d9ffc31e722ece82al43 
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c&tab=core&_cview= 1 (last visited 12/6/18) ("There is no requirement for offerors to have 
accredited classified environments at the time of proposal.").) 

115. Contrary to what one might assume based on the Gate Criteria, the Cyber Security 
Plan does not require the awardee to have data centers or offerings authorized through 
FedRAMP. (Van Name Test, at 100:5-14 ("[W]e are not requiring, as part of the JEDI 
cybersecurity plan, that the winner go through the FedRAMP process before DoD uses the final 
solution"); id. at 101:3-6 ("Q: So if I understand correctly, your cybersecurity plan does not 
require FedRAMP authorization. A: Correct."); see also id. at 100:13-14, 101:3-5, 101:13-15; 
JEDI Cloud Q&A Matrix at 13, Hearing Ex. B (Response to question 1577 ("The word choice 
between compliant versus authorized is deliberate. The Cyber Security Plan does not require 
prior accreditation or certification.").) The FedRAMP process apparently is too slow and 
accredited offerings are too limited for DoD. 

116. Instead, the JEDI Cloud RFP and Cyber Security Plan contemplate that DoD will 
work with the awardee to ensure the proposed offerings and data centers comply with the JEDI 
Cloud Cyber Security Plan outside of the FedRAMP process. Specifically, post-award, DoD will 
assess the awardee's Cloud offering against the JEDI Cloud security requirements by a review 
and assessment of CDRL 11, the Security Authorization Package. (Van Name Test, at 101:7- 
103:15; see also AR Tab 5K, CDRL 11 at 156.) 

117. The JEDI Cloud RFP CDRL provisions make clear that the awardee is not 
required to submit its Security Authorization Package in CDRL 11 to DoD until 30 days after 
contract award, and DoD does not commit to a timeframe for the assessment. (AR Tab 5K, 
CDRL 11 at 156 ("Submit the Unclassified Security Authorization Package 30 days after 
contract award"); Van Name Test, at 102:2-103:15 (conceding that government did not commit 
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to complete review of the awardee's plan within 30 days of the contract award).) 

118. The RFP provides no specific location information for the services covered by the 
JEDI Cloud contract. (JEDI Cloud Q&A Matrix at No. 1377, https://www.fbo.gov/index?s= 
opportunity&mode=form&id=3860a4f4fe9d9ffc31 e722ece82a 143c&tab=core&_cview= 1 (last 
visited 12/6/18) (potential offeror stating that the "Government must identify locations for 
service as to ensure response, availability and support," and Department responding: "Your 
comment has been noted.").) 

119. RFP Section B includes multiple CLINs for each ordering period of performance. 
(AR Tab 35, RFP Am. 2 at 715-25.) 

120. CLIN xOOl covers unspecified Unclassified IaaS and PaaS offerings, which the 
RFP indicates offerors will price by catalog. (Id. at 715.) 

121. CLIN x002 covers the unspecified IaaS and PaaS offerings in a classified 
environment, which the RFP indicates the offerors will price by catalog. (Id.) 

122. CLIN x003 covers an Unclassified Cloud Support Package, which the RFP 

indicates offerors will price by catalog. (Id.) The RFP does not define a specific or finite scope 

of work for the Cloud Support Package service, purportedly to leave DoD flexibility: 

Unclassified offerings of catalog support to advise and assist with architecture, 
usage, provisioning, and configuration of IaaS and PaaS, to include homefront to 
the tactical edge. Package services may advise and assist with integration, 
aggregation, orchestration, and troubleshooting of cloud services. Package may 
include training services, materials, and documentation for available services. 

This is not a time-and-materials or labor-hour based CLIN. 

(Id.; see also AR Tab 27, Amended SOO at 614 (§ 3.24).) 

123. CLIN x004 covers the Classified Cloud Support Package, which the RFP also 

indicates offerors will price by catalog. For CLIN x004, the RFP includes the same vague 

description as CLINs x003 except the series x004 CLIN covers "classified offerings." (AR Tab 
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35, RFP Am. 2 at 716.) 

124. CLIN x005 covers the Portability Plan for which each offeror must propose a firm 
fixed price. {Id.) The Portability Plan is a set of user instructions to "extract all online, nearline, 
and offline data, including, but not limited to, databases, object and file storage, system 
configurations, cloud activity logs, source code hosted in a JEDI Cloud code repository, and 
network configurations" to migrate from JEDI Cloud to another environment. (AR Tab 27, 
Amended SOO at 611 (§ 3.16.1).) 

125. CLIN x006 covers a Portability Test demonstrating the portability of data and 
applications to other hosting environments, for which each offeror must propose a firm fixed 
price. (AR Tab 35, RFP Am. 2 at 717.) As with the other CLINs, the RFP does not provide a 
finite scope of work for the Portability Plan or the Portability Test services. 

126. In the draft RFP bidder questions, an offeror noted that "[developing a Firm 
Fixed Price for a Portability Plan will require the scope of what is being ported." (JEDI Cloud 
Q&A Matrix at No. 1643, https://www.fbo.gov/index?s=opportunity&mode=form&id=3860a4f4 
fe9d9ffc31e722ece82al43c&tab=core&_cview=l (last visited 12/6/18).) DoD responded that 
the offerors shall assume that "the scope and complexity of the applications and data described in 
the Price Scenarios are illustrative examples" of what DoD intends to port to inform the pricing 
for the Portability Plan and Test CLINs. (Id.) The RFP cautions, however, that "the 
Government is not limited to those illustrative examples in post-award contract execution." (AR 
Tab 35, RFP Am. 2 at 797.) 

127. CLIN x007 covers Cloud Computing Program Office Program Management 
Support, i.e., the Program Management Office (at least a Program Manager and Deputy Program 
Manager), process and tools necessary for the contractor to manage and oversee all contract 
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activities, including, e.g., "facilitating the timely authentication and authorization of JEDI Cloud 
infrastructure and offerings at all classification levels and coordinating successful integration of 
the DoD's provisioning tool," monitoring and reporting on contract status and Service Level 
Agreements, Quality Assurance activities, and reporting on small business participation. {Id. at 
717, 727.) Each offeror must propose a monthly fixed price for CLIN x007. {Id. at 717.) 

128. The REP anticipates that the contractor continually will add new or improved 
IaaS, PaaS, or Cloud Support services to the contract by (i) advising the CO of new services that 
the vendor has made publicly available in the vendor's CONUS commercial cloud, or (ii) 
notifying the CO of potential new services in advance of availability in the vendor's CONUS 
commercial cloud. {Id. at 736.) Pursuant to RFP Section H2, the price of any new unclassified 
services shall not be higher than the price that is publicly available in the commercial cloud plus 
any applicable discounts, premiums, or fees the CSP proposed in RFP Attachment J-3. {Id.) If 
offered in advance of availability into the commercial marketplace, the CO will make a 
commerciality determination about the new service and may require cost and pricing data or 
other than cost and pricing data as required by FAR 15.4. {Id.) 

129. The pre-submission offeror questions to DoD contemplate "multiple catalog 
[change] submissions on a daily or weekly basis as new services are released" post award. {See, 
e.g., AR Tab 32, JEDI Cloud Industry and Gov QA Final RFP at 656 (Q17).) In fact, the offeror 
questions anticipate changes to the proposed services and prices even during the evaluation 
period . {Id. at 664 (Q86 and Q87).) Gartner notes that major cloud providers may release 40 to 
50 new features in any given month . 14 

14 Chris Pemberton, Hidden Cloud Opportunities for Technology Service Providers, Gartner 
(June 20, 2018), https://www.gartner.com/smarterwithgartner/7-hidden-cloud-growth- 

opportunities-for-technology-service-providers/ (last visited 12/6/2018). 
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130. For new classified services, RFP Section H2 provides that the "price incorporated 
into the JEDI Cloud catalog ... may include a price premium compared to the unclassified 
services because of the additional security requirements." (Id. at 736-37.) That premium, per 
Section H2, will be the lesser of the premium applicable to the most comparable classified 
service at the time of contract award, the classified price premium offered by the CSP in its 
proposal for Section H2, or the premium proposed by the CSP at the time it offers the new 
service to DoD. {Id. at 737.) 

131. The RFP includes six pricing scenarios (the "Price Scenarios") to guide both the 
technical and price evaluation. (AR Tab 36, Amended Price Scenarios.) 

132. For all scenarios, the RFP directs the offerors to make certain assumptions unless 
stated otherwise, e.g., the required solution is for an unclassified JEDI Cloud requirement, the 
service will take place in the offeror's most expensive CONUS region or zone, all services and 
resources are utilized continuously and all storage and data is retained for the duration of the 
order, and migration of any application is instantaneous on day 1 of the order. {Id. at 811.) 

133. The RFP instructs offerors to include a Priced and Unpriced Basis of Estimate 
("BOE") and a price build-up, for each Price Scenario. (AR Tab 35, RFP Am. 2 at 796-97.) 

134. Each offeror must submit four catalogs, one each for: CLIN xOOl Unclassified 
IaaS and PaaS Offerings; CLIN x002 Classified IaaS and PaaS Offerings; CLIN x003 
Unclassified Cloud Support Package; and CLIN x004 Classified Cloud Support Package. {Id.) 

135. The RFP requires DoD to evaluate each offeror's Price Volume for accuracy and 
completeness. (Id. at 807.) As related to Task Order 1, the RFP requires DoD to evaluate the 
price to determine if it is "fair and reasonable, complete and accurate." (Id.) 

136. DoD also must calculate a Total Evaluated Price, which equals the sum of the 
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total proposed prices for Price Scenario 1 through 6, 4 times the Proposed Unit Price for CLIN 

0005, 6 times the Proposed Unit Price for CLIN 1005, 6 times the Proposed Unit Price for CLIN 

2005, 4 times the Proposed Unit Price for CLIN 3005, 4 times the Proposed Unit Price for CLIN 

0006, 6 times the Proposed Unit Price for CLIN 1006, 6 times the Proposed Unit Price for CLIN 

2006, 4 times the Proposed Unit Price for CLIN 3006, 24 times the Proposed Unit Price for 
CLIN 007, 36 times the Proposed Unit Price for CLIN 1007, 36 times the Proposed Unit Price 
for CLIN 2007, and 24 times the Proposed Unit Price for CLIN 3007. (Id. at 807-08.) 

137. The RFP does not contemplate any evaluation of the four proposed price catalogs 
except to confirm the accuracy of any prices used in the Price Scenario build-ups. (Id.) Each 
catalog may contain "hundreds if not thousands of items." (COSF at 19 (f 51).) 

2. The ”Go/No Go” Gate Criteria 

138. As indicated, Step 1 involves a pass/fail evaluation against seven "Gate Criteria" 
(id. at 801-03), and the failure to meet even one will result in an Unacceptable rating, and render 
the offeror ineligible to compete for award. (Id.; see also Van Name Test, at 78:12-79:1. 

139. The Agency developed the Gate Criteria to limit competition and avoid protests: 

The JEDI Cloud program schedule could be negatively impacted if source 
selection extends beyond the planned timeline due to an unexpected number of 
proposals or lengthy protest delays. To mitigate this risk, the solicitation will use 
a gated evaluation approach that includes "go / no-go" gate criteria. Offerors must 
meet the established minimum criteria in order to be considered a viable 
competitor. 

(AR Tab 21, Business Case Analysis at 418; AR Tab 25, Acquisition Strategy at 500.) 

140. DoD has noted the existence of a robust commercial cloud services market. (AR 

Tab 20, Market Research Report at 362.) But only four potential offerors accepted the Agency's 

invitation in the final RFP to attend an in-person question and answer session for those vendors 

"who plan to submit a proposal in response to the JEDI Cloud RFP." (AR Tab 1, RFP at 66; 
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Compare Agency MOL at 44 with AR Tab 23, Acquisition Plan at 433-34.) 

141. Gate Criteria 1.1, 1.2, and 1.6 are unduly restrictive and unduly limit competition. 

a. Gate Criterion 1.1: Elastic Usage 

142. Gate Criterion 1.1 requires each offeror to demonstrate "for evaluation purposes" 
that the identified JEDI Cloud unclassified usage numbers are less than 50% of the Commercial 
Cloud Offering usage during the months of January-February 2018 as measured against three 
metrics: (i) Network - volume of commercial client traffic in bytes in and out of the controlled 
infrastructure; (ii) Compute - number of physical compute cores in use by applications; and (iii) 
Storage - data in bytes for each online, nearline, and offline. (AR Tab 35, RFP Am. 2 at 787.) 

143. The RFP defines past usage to include "any market segment" of customers 
(government (non-JEDI) and commercial), but excludes the CSP's own usage. (Id. at 787.) 

144. The Agency's stated rationale for the metrics selected is to ensure the JEDI Cloud 
offeror has surge capacity for unexpected future events and is invested in commercial innovation. 
(AR Tab 42, Gate Mem. at 940-42; Van Name Test, at 80:5-14, 88:19-89:1.) 

145. But Gate Criterion Subfactor 1.1 does not measure the offeror's proposed 
capability at the time of award. As written, Subfactor 1.1 measures the offeror's usage as of 
January and February 2018 - fifteen months prior to award and nine months prior to proposal 
submission. (AR Tab 35, RFP Am. 2 at 787.) 

146. The contemporaneous record contains no justification for the selected time period. 
The Agency has explained that it selected these two months preceding the draft RFP release to 
prevent offerors from "gaming" their usage numbers: 

We picked January and February, because it was before we had released our first 

draft. It was before we had announced that this would be a metric. And 

understanding the technology, I also understand that these metrics would be 

particularly easy to game, if you were so inclined to do so. One strategy that 
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would be fairly simple might be offering freely available cloud services for 
anyone who wants to use them, to boost the usage numbers of compute 
networking and storage, which are the three criteria in this particular factor. 

(Van Name Test, at 27:5-10; see also id. at 28:8-14 ("[I]f we were to change it to 60 days before 

proposal, again, it would be fairly easy for a vendor to have gamed out those numbers.").) 

147. Other less restrictive means of evaluating the offeror's capacity and investment 
existed, yet the Agency elected not to structure the RFP in that manner. For instance, if DoD had 
a legitimate concern about offerors manipulating their usage, DoD could resolve the issue by 
seeking data both in January and February 2018 as well as more recent usage data and asking 
offerors to explain any differences. 

b. Gate Criterion 1.2: High Availability and Failover 

148. Gate Criterion 1.2 mandates that each offeror have, at the time of proposal 
submission, no fewer than (i) three physically existing data centers, (ii) within the customs 
territory of the United States, (iii) separated by at least 150 miles, (iv) capable of automated 
failover, and (v) each "supporting at least one IaaS and one PaaS offering that are FedRAMP 
Moderate 'Authorized' by the Joint Authorization Board (JAB) or a Federal agency as 
demonstrated by official FedRAMP documentation." (AR Tab 35, RFP Am. 2 at 788; AR Tab 
32, JEDI Cloud Industry and Gov QA Final RFP at 657 (see Government Response to Q26 and 
Q27); AR Tab 42, Gate Mem. at 943; Van Name Test, at 93:22-94:7.) 

149. DoD first specified FedRAMP authorization of the offerings and data centers as a 
Gate Criterion in the final RFP issued on July 26. 2018 . (Compare Draft RFP at 89, Hearing Ex. 
L (requiring "FedRAMP Moderate compliant ") with AR Tab 35, RFP Am. 2 at 788 (requiring 
"FedRAMP Moderate 'Authorized' by the Joint Authorization Board (JAB) or a Federal agency 
as demonstrated by official FedRAMP documentation"); Van Name Test, at 95:11-17.) 
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150. This gave potential competitors less than two months to obtain government 
authorization for a process that takes six months to complete. Compare AR Tab 1, RFP at 67 
(requiring proposals by September 17, 2018) with FedRAMP Accelerated A Case Study for 
Change Within Government, https://www.fedramp.gov/assets/resources/documents/FedRAMP_ 
Accelerated A Case Study_For_Change_Within_Govemment.pdf (last visited 12/6/18) (noting 
FedRAMP efforts to reduce authorization timeline to six months); cf. 48 C.F.R. § 9.205 
(directing agencies to give sufficient time for qualification before award). 

151. "FedRAMP authorized is a designation that the Cloud Service Provider's systems 
have completed the FEDRAMP authorization process." https://www.fedramp.gov/faqs/ (last 
visited 12/6/18). Two acceptable paths of authorization exist: a JAB provisional authorization or 
an initial agency authorization, https://www.fedramp.gov/understanding-baselines-and-impact- 
levels/ (last visited 12/6/18). 

152. FedRAMP prohibits federal agencies from requiring authorization as a 
prerequisite for bidding on a federal cloud services solicitation: "Federal Agencies cannot require 
CSPs to be FedRAMP authorized as part of their RFP but can state that a CSP needs to be 
FedRAMP authorized once federal data is placed in the system." FedRAMP Tips & Cues 
Compilation 2015-2017 (Jan. 2018) at 7, https://www.fedramp.gov/assets/resources/documents/ 
FedRAMP_Tips_and_Cues.pdf (last visited 12/6/18); see also id. at 13 (" Agencies can request a 
CSP to have a timeline for obtaining an ATO but should not limit the request to CSPs with 
ATOs, "). 

153. As noted, the security requirements in the JEDI Cloud Cyber Security Plan, i.e., 
the contract requirements versus the Gate Criterion, do not require FedRAMP authorization . 
(Van Name Test, at 100:1-8 ("And we are not requiring as part of the JEDI cybersecurity plan, 
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that the winner go through the FedRAMP process before the DoD uses the final solution....").) 

154. The RFP specifies this Gate Criterion "to validate that JEDI Cloud can provide 
continuity of services for DoD's users around the world." (AR Tab 42, Gate Mem. at 943.) 

155. DoD chose three data centers "to provide reliability and resiliency of services 
even in the unlikely circumstance that two datacenters are simultaneously affected." (Id.; Van 
Name Test, at 91:22-92:9.) 

156. But DoD's need for these failover capabilities will not arise until DoD data is 
placed in the cloud. (Van Name Test, at 92:10-15.) In fact, DoD confirmed in response to 
offeror solicitation questions that DoD has no need for three operational unclassified data centers 
until after contract award : " The requirement is that the three unclassified data centers must be 
online and available thirty days after the conclusion of the post award kick-off event ." (AR Tab 
32, JEDI Cloud Industry and Gov QA Final RFP at 671.) 

157. DoD's response to bidder questions also establishes that Subfactor 1.2 does not 
relate to the contract requirements, advising that the offerings proposed to pass the gate may bear 
no relationship to the offerings proposed for the JEDI Cloud users: "However, the Government 
notes that the RFP does not restrict an Offeror from proposing its latest technologies, even if not 
FedRAMP authorized at the time of proposal. The RFP does not prescribe which specific IaaS 
offering and which specific PaaS offering is used to satisfy the Sub-Factor 1.2 Gate Criterion." 
(AR Tab 40, JEDI Cloud Industry and Gov QA for Amend 001 at 849 (question 233).) 

158. DoD can point to no other government procurement that limited the competitive 
field to offerors with three existing, geographically dispersed data centers, running FedRAMP 
Moderate authorized offerings. (Van Name Test, at 75:14-18, 76:22-77:5.) 

159. Less restrictive and more reasonable alternatives exist. For instance, DoD could 
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require each offeror's proposal to show how the proposed data centers will comply with the 
security controls in the JEDI Cloud Cyber Security Plan and the timeline to get there. 

c. Gate Criterion 1.6: Commercial Cloud Offering Marketplace 

160. Gate Criterion 1.6 requires offerors to demonstrate at the time of proposal 
submission that the offeror's Cloud Computing Offering includes an easy to use capability to 
deploy DoD licensed software and an online marketplace of third-party platform offerings and 
third-party enterprise software offerings. (AR Tab 35, RFP Am. 2 at 789-90.) 

161. DoD seeks to evaluate "the range of offerings in such a marketplace," and confirm 
that "the user can easily go from the entry point (post log in) to deployment of the offering in a 
reasonable timeframe." (AR Tab 42, July 23, 2018 Gate Mem. at 947.) 

162. The JEDI Cloud contract also will require the awardee to provide integrated 
billing features for online marketplace users. (AR Tab 35, RFP Am. 2 at 744.) At the hearing, 
the DDS Deputy Director and signatory of the Gate Memoranda, explained: "So if a—if a user 
spins up some instances, and deploys maybe a database offering out of the online marketplace, 
that has an associated cost, right, the billing for that particular offering should be billed to the 
account, as part of the integrated billing tool." (Van Name Test, at 108:9-19.) 

163. Van Name clarified that to "spin up" means "to provision an instance," but 
conceded that DoD effectively would be procuring third-party software when JEDI Cloud users 
provision an offering from the vendor's on-line marketplace: ”[e]ffectively, yes, the government 
is incurring an expense, right we're using a service." (Id. at 108:20-109:10; id. at 109:11-22.) 

164. Other aspects of the RFP, including the SOO, contain provisions related to the 
offeror's online marketplace. (See AR Tab 35, RFP Am. 2 at 744-45 (Clause H10) and AR Tab 
27, Am. SOO at 612 (§3.18.2).) 
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165. For example, RFP Section M requires the Agency to "evaluate the degree to 
which" the offeror's proposed solution reflects an understanding of the SOO requirements when 
assigning adjectival ratings under Factors 2 through 7. (AR Tab 35, RFP Am. 2 at 803.) 

166. The Agency's Gate Memorandum does not cite any authority to procure an online 
marketplace and DoD has not identified any. (AR Tab 42, Gate Mem. at 946-47.) 

E. The CO's Conflicts Of Interest Analysis 

167. On July 23, 2018, three days before posting the final RFP, the CO issued a 
memorandum for the record indicating that "there were four instances of individuals where 
potential financial conflicts of interest under 18 U.S.C. § 208 or impartiality restrictions under 5 
C.F.R. § 2635.502 were provided with access to procurement sensitive information." (AR Tab 
33, Integrity Mem. at 679.) The CO observed that each "individual had either a financial interest 
in or a covered relationship with Amazon, Inc./Amazon Web Services (AWS) ...," and stated 
that Agency ethics counsel purportedly concluded "that no violation had occurred because these 
individuals had not participated personally and substantially in the procurement." (Id.) 

168. Ubhi and DeMartino are two of the individuals discussed in the CO's 
memorandum. (Id. at 681-83.) 

1. Deap Ubhi 

169. The CO's memorandum dedicated less than one page to the Ubhi conflicts: 

Facts: 

1. It was brought to the Contracting Officer's attention that Mr. Ubhi was 
previously employed with AWS, which ended in January 2016. 

2. Mr. Ubhi was employed with Defense Digital Service from August 22, 

2016 to November 27, 2017.[] 

3. The JEDI Cloud acquisition was initiated on September 13, 2017 and Mr. 

Ubhi was involved with JEDI Cloud market research activities between 
September 13, 2017 and October 31, 2017. 
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4. Because greater than one year had lapsed between when his AWS 
employment ended and when his participation in JEDI Cloud started, no 
restrictions attached to prohibit Mr. Ubhi from participating in the 
procurement. 

5. In late October 2017, AWS expressed an interest in purchasing a start-up 
owned by Mr. Ubhi. On October 31, 2017, Mr. Ubhi recused himself from 
any participation in JEDI Cloud. His access to any JEDI Cloud materials was 
immediately revoked, and he was no longer included in any JEDI Cloud 
related meetings or discussions. 

Conclusion: Mr. Ubhi's regulatory impartiality restriction had expired long before 
the JEDI Cloud procurement was initiated and his participation was limited to 
market research activities. Mr. Ubhi promptly recused himself from participating 
in JEDI Cloud once AWS expressed interest in doing business with him. 
Therefore, Mr. Ubhi's connections to AWS did not negatively impact the integrity 
of the JEDI Cloud acquisition. 

(Id. at 682-83.) 

170. The CO considered only whether Ubhi joined the JEDI Cloud acquisition team 
more than one year after leaving AWS and concluded that his connections to AWS did not 
negatively impact the JEDI Cloud acquisition. 

171. Despite knowing that AWS sought to purchase a start-up company from Ubhi 
during the JEDI procurement and indicating that Ubhi "promptly" recused himself, the CO did 
not investigate the communications or dealings at all. (AR Tab 33, Integrity Mem. at 682-83.) 
The CO did not investigate when the communications began, how they started, what AWS 
offered, etc. (CO Test, at 251:7-11 (testifying that she had not spoken to Ubhi: "All the 
information that I have is secondhand information."); id. at 261:7-262:18 ("I can't speculate on 
what he was doing in the summer of 2017.... And I don't know at which point it was decided to 
go into discussions with Amazon.").) 

172. Even Ubhi's notice indicates that the discussions were not new. (See AR Tab 45, 
Ubhi Recusal at 2773-74 (indicating " further partnership discussions " with AWS).) 
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173. The CO's Memorandum also does not mention that Ubhi returned to AWS in a 
leadership position in late November 2017. (Linkedln Profile, Ex. 1 to Consol. Protest.) IS 

174. The CO also did not investigate the AWS-Ubhi employment communications. 

175. The CO's Memorandum does not identify the non-public information to which 
Ubhi had access during his tenure at DDS or identify the documents on which he worked. 

176. The CO did not interview Ubhi, review Ubhi's communications during the 
acquisition, identify and review each of the documents to which Ubhi had access, or consider 
Ubhi's current employment with AWS. (CO Test, at 208:1-6, 214:18-19, 223:12-14, 247:6-7; 
250:18-251:11, 262:3-4; 262:20-263:6; Supp. COSF at 12 (f 33.)) 

2. Anthony DeMartino 

177. As with Ubhi, the CO's analysis of the DeMartino JEDI conflicts of interest spans 
less than one page: 

Facts: 


1. It was brought to the Contracting Officer's attention that Mr. DeMartino 
previously provided consulting services to AWS while employed with 
SDB Advisors. Mr. DeMartino ended his SDB Advisors employment in 
January 2017. 

2. Mr. DeMartino worked as a Chief of Staff/Deputy Chief of Staff for the 
Deputy Secretary and Secretary, respectively. In this capacity, he scheduled 
and attended meetings relative to the JEDI Cloud procurement, which did 
include access to pre-decisional documents concerning JEDI Cloud 
procurement acquisition strategy and other matters during the Fall and 
Winter of 2017. Mr. DeMartino recorded meeting minutes and had no input 
or involvement in the reviewing or drafting of the draft solicitation package, 
the Acquisition Strategy, Business Case Analysis, or other pre-decisional 
sensitive documents relative to the JEDI Cloud acquisition. 

3. Mr. DeMartino worked with SOCO throughout his DoD employment to 
ensure compliance with all applicable ethics rules. 

15 Ubhi's Linkedln profile curiously indicates that he left DDS in August 2017 (prior to the 
Agency's timeline for the start of the JEDI Cloud requirement), despite that he did not leave until 
late 2017. (Linkedln Profile, Ex. 1 to Consol. Protest.) 
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Conclusion: Mr. DeMartino's involvement was ministerial and perfunctory in 

nature and he provided no input into the JEDI Cloud acquisition documents and 

did not participate personally and substantially in the procurement. Therefore, Mr. 

DeMartino's involvement did not negatively impact the integrity of the JEDI 

Cloud acquisition. 

(AR Tab 33, Integrity Mem. at 681.) 

178. The CO averred that she "had personal knowledge of the nonpublic information to 
which DeMartino had access." (Supp. COSF at 6 (| 15)). But the CO did not talk to DeMartino 
or review his emails or other documentation to test her conclusions. (CO Test, at 291:11-14; id. 
at 300:2-9 ("I didn't investigate ... all of the emails and everything that he sent.... I wasn't aware 
of this ... article from anyone at Amazon.... I largely relied on conversations that I had with the 
DSS legal counsel who provided advice in concert with SOCO."); Supp. COSF at 12 (| 33 
("there are relatively few documents that I considered in my investigation").) 

179. The CO did not even remember when, or exactly how, the issue of DeMartino's 
conflict of interest came to her attention. (CO Test, at 273:16-22, 274:1-5.) 

180. The CO had not seen the prior ethics warning that SOCO issued to DeMartino 
prior to completing her integrity investigation. (Id. at 274:12-275:13.) 

181. The CO also did not speak to SOCO during her investigation (id. at 280:4-8), or 
consider the materials that SOCO reviewed when it directed DeMartino in April 2018 not to 
participate further in the JEDI Cloud acquisition (id. at 279:1-280:3). 

F. Congressional Concern With The JEDI Cloud Procurement 

182. Congress repeatedly has questioned DoD's JEDI Cloud strategy and requirements. 
In March 2018, after DoD revealed at industry day its intent to structure the RFP for a single 
IDIQ contract award, Congress directed DoD to submit two reports to the congressional defense 
committees, the first from the Deputy Secretary of Defense on the JEDI Cloud RFP, and the 
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second explaining the single award strategy, the parts of DoD that will use the contract, and the 
exit strategy. See Legislative Report accompanying Consolidated Appropriations Act of 2018, 
Pub. L. No. 115-141 (Mar. 23, 2018), https://docs.house.gov/billsthisweek/20180319/DIV% 
20C%20-%20DEFENSESOM%20FY18%200MNI.OCR.pdf at 88-89 (last visited 12/6/18). 

183. DoD submitted a Combined Report to Congress in May 2018, and published the 
report with the final RFP. (See Final Cloud Combined Congressional Report, Protest Ex. I.) 

184. The report observes that "DoD is best served by a robust, competitive and 
innovative technology base" id. at 4, but states that if DoD "pursued multiple-award contracts for 
the JEDI Cloud, each individual task order would be competed, thus being paced by DoD 
acquisition process...." (Id. at 3.) 

185. The report also states that the JEDI Cloud contract will be firm-fixed price and 
purportedly employ "pre-negotiated catalogs resulting from the full and open competition." Id. 
at 10. DoD observed, however, that the "JEDI Cloud contract will require ongoing commercial 
parity of technical offerings so long as the evolving capabilities comply with Department 
security requirements." Id. In other words, "the contract requires that the capabilities and prices 
delivered to DoD keep pace with commercial innovation." Id. 

186. After receiving the Combined Report, Congress' concerns with the JEDI Cloud 
acquisition did not dissipate. In the Department of Defense and Labor, Health and Human 
Services, and Education Appropriations Act, 2019 and Continuing Appropriations Act (the 
"Act"), passed in late September 2018, Congress imposed three additional obligations on DoD 
related to the JEDI Cloud contract: (i) DoD must have a detailed acquisition plan to sustain 
competition among CSPs under the JEDI Cloud contract: (ii) the Secretary of Defense must 
submit a report to Congress describing that acquisition strategy; and (iii) DoD must wait 90 days 
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after submission of that report to obligate or spend any funds for migration of data to the JEDI 
Cloud contract. Pub. L. No. 115-245, § 8137 at 50-51 (Sept. 27, 2018). 

187. Additionally, in late October 2018, two Congressmen wrote a letter to the DoD 
Inspector General requesting an investigation into the JEDI Cloud RFP development and 
acquisition strategy, expressing concern about provisions that restrict competition and 
questioning conflicts of interest by involved DoD personnel. See Congressional Letter to Acting 
Inspector General Fine, https://federalnewsnetwork.com/wp-content/upIoads/2018/10/JEDI-IG- 
Letter-FINAL-10.22.18.pdf (last visited 12/6/18). 

G. Oracle’s Pre-Award Protest To GAO 

188. Oracle filed its initial pre-award protest challenging the RFP on August 6, 2018, 
well before the RFP's original proposal submission deadline of September 17, 2018. (See Oracle 
Initial Protest, B-416657.1.) After multiple RFP amendments and a supplemental protest, Oracle 
filed, at GAO's request, a consolidated protest on September 6, 2018. {See Oracle Revised and 
Consolidated Supplemental Protest, B-416657.1,.2.) 

189. Oracle's GAO protest timely raised several challenges to the RFP, including each 
of the issues addressed in this protest. {See id ; see also Oracle Comments on Agency Report and 
Third Supplemental Protest, B-416657.1, .2, .3, .4.) 

190. Following further record production and briefing, GAO conducted a hearing on 
October 11, 2018 involving testimony from two DoD witnesses, the CO and DDS Deputy 
Director, and addressing only a subset of Oracle's protest grounds, including, e.g., the restrictive 
RFP Gate Criteria, and the CO’s investigation of potential conflicts of interest and appearances of 
impropriety. {See Oct. 3, 2018 GAO Hearing Notice.) 

191. GAO denied Oracle's protest in a decision issued under protective order on 
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November 14, 2018 and made public on November 19, 2018. See Oracle Am., Inc., B-416657 
et. al., Nov. 14, 2018, 2018 WL 6040648. GAO did not address several of the arguments raised 
by Oracle, declared one argument premature, and erred as to the arguments it did address. 

H. Harm To Oracle, Public Interest, And Lack Of Harm To DoD 

192. The balance of harms and public interest favor the injunctive relief Oracle seeks. 

193. Absent injunctive relief, Oracle will suffer the irreparable harm of being deprived 
of the opportunity to compete fairly for a contract, see, e.g., Palantir USG, Inc. v. U.S., 129 Fed. 
Cl. 218, 291 (2016), ajfd, 904 F.3d 980 (Fed. Cir. 2018); Magnum Opus Techs., Inv. v. U.S., 94 
Fed. Cl. 512, 544 (2010), and Oracle will have to compete in procurement that transgresses 
applicable laws and regulations. Weeks Marine v. U.S., 575 F.3d 1352, 1361-62 (Fed. Cir. 
2009); WinStar Commc’ns, Inc. v. U.S., 41 Fed. Cl. 748, 762-63(1998) (holding protester 
prejudiced where agency improperly adopted a single-award IDIQ acquisition approach). 

194. The public interest also favors injunctive relief to remedy the procurement errors 
and violations of law identified herein and to prevent lack of public trust and confidence in the 
integrity of this procurement. See e.g, Palantir USG, 129 Fed. Cl. at 294-95 (citing BINL, Inc. 
v. U.S,, 106 Fed. Cl. 26, 49 (2012) ("With regard to the public interest, it is well-settled that there 
is a public interest in remedying violations of law.")); see also e.g., Ian, Evan & Alexander Corp. 
v. U.S., 136 Fed. Cl. 390, 430 (2018) ("an injunction will promote the integrity of the 
procurement process by holding the government accountable when it takes actions that are 
contrary to law and may result in cost-savings for the government.") 

195. The irreparable harm to Oracle and the public interest outweigh any harm DoD 
may claim as a result of delays to the procurement. Any alleged delay claimed by DoD is a self- 
inflicted injury based on refusal to ensure that DoD conducted this significant procurement in 
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accordance with the law, in a manner above approach, with complete impartiality, and with 
preferential treatment for none. See, e.g., Univ. Research Co., LLC v. U.S., 65 Fed. Cl. 500, 515 
(2005) (granting preliminary injunction and recognizing that "the public's interest in the integrity 
of the procurement process outweighs the public's interest in the timely completion of the 
government procurement process"); PGBA, LLC v. U.S., 57 Fed. Cl. 655, 663 (Fed. Cl. 2003) 
("only in an exceptional case would [such delay] alone warrant a denial of injunctive relief...."). 

COUNT I 

The Agency's Determination For A Single IDIQ Award Violates The Law 

196. Oracle incorporates paragraphs 1 through 195 of the Complaint by reference. 

197. The Agency seeks to avoid Congress' prohibition on using a single source IDIQ 
award for this ten billion dollar, ten-year contract based on the Under Secretary's flawed 
determination that the JEDI Cloud contract will only involve "FFP task orders for services for 
which prices are established in the contract for the specific tasks to be performed." (AR Tab 16, 
D&F at 317.) But the contract contemplated by the RFP requires the awardee to regularly add 
new offerings to the contract at prices not yet determined and the RFP does not outline the 
specific tasks at all. The Agency's attempt to circumvent Congress' plain prohibition necessarily 
fails as a matter of basic statutory interpretation. 

198. This Court must set aside any agency action that is "arbitrary, capricious, an abuse 
of discretion, or otherwise not in accordance with law" or "without observance of procedure 
required by law." 5 U.S.C. § 706(2)(A), (D). 

199. This Court will grant relief for an offeror that demonstrates the agency's 

procurement conduct violates applicable statutes or regulations. See 28 U.S.C. § 1491(b)(4); 

Banknote Corp. of Am., Inc. v. U.S., 365 F.3d 1345, 1351 (Fed. Cir. 2004); 5 U.S.C. § 706(2)(A), 

(D); Palantir USG, Inc. v. U.S., 904 F.3d 980 (Fed. Cir. 2018) (affirming Court decision 
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sustaining protest for failure to follow U.S. Code commercial item provision). 

200. For IDIQ contracts estimated to exceed $112 million, statute and regulation 
prohibit a single award unless the head of the contracting activity (or senior procurement 
executive for DoD procurements) determines in a written determination that one of four stated 
exceptions exists. See 10 U.S.C. § 2304a(d)(3); 48 C.F.R. § 16.504(c)(l)(ii)(D); 48 C.F.R. § 
216.504(c)(l)(ii)(D). FAR 1.704, in turn, requires that "[e]ach D&F shall set forth enough facts 
and circumstances to clearly and convincingly justify the specific determination made" and to 
"detail the particular circumstances, facts, or reasoning essential to support the determination." 

201. The U.S. Code identifies the following four single source prohibition exceptions: 

(A) the task or delivery orders expected under the contract are so integrally 
related that only a single source can efficiently perform the work; 

(B) the contract provides only for firm, fixed price task orders or delivery orders 
for- 

(i) products for which unit prices are established in the contract; or 

(ii) services for which prices are established in the contract for the specific 
tasks to be performed; 

(C) only one source is qualified and capable of performing the work at a 
reasonable price to the government; or 

(D) because of exceptional circumstances, it is necessary in the public interest to 
award the contract to a single source. 

10 U.S.C. § 2304a(d)(3); 48 C.F.R. § 16.504(c)(l)(ii)(D)(l)(ii). To the extent that the agency 
seeks to use the "public interest" exception, the agency must notify Congress within thirty days. 
48 C.F.R. § 16.504(c)(l)(ii)(D)(2). 

202. "The requirement for a determination for a single-award contract greater than 
$112 million-(i) Is in addition to any applicable requirements of [FAR] Subpart 6.3...." Id. at 
§ 16.504(c)(l)(ii)(D)(3). 
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203. The statutory requirement for a D&F to permit single award of an IDIQ contract 
estimated to exceed $112 million also is separate and apart from the requirement that a 
contracting officer "must, to the maximum extent practicable, give preference to making multiple 
awards of indefinite-quantity contracts" and document the basis for any decision to make a single 
award. See U.S.C. § 2304a(d)(3); 48 C.F.R. § 16.504(c)(l)(ii)(C); see also Fed. Reg. Vol. 75, 
No. 52, 13416, 13419, 13420 (Mar. 29, 2010) (cmt. 10) (confirming distinct nature of 
requirements). 

204. The statutory prohibition on large, single source IDIQs reflects Congress' 
admonition (bom of experience) that agencies maximize use of multiple award IDIQ contracts in 
order to achieve the benefits of task order level competition. Relevant legislative history 
explains that the statutory prohibition serves to "ensure that future contracts of this type provide 
for the competition of task and delivery orders unless there is a compelling reason not to do so." 
S Rep. 110-77 at 368 (June 5, 2007). 

205. The regulatory history to the FAR's implementing provisions explains the noted 
benefits of task order competition: 

The objective of this provision is to place greater emphasis on awarding multiple 
award contracts and enhancing the fair opportunity provisions within FAR 
Subpart 16.5. Competition of orders leads to improved contractor performance, 
stimulation of technological solutions, and reduction of costs over time. The 
tenets of this provision strike at the core of enhancing competition and ensuring 
competition continues to exist even after award of initial contract vehicles.... 

73 Fed. Reg. 54008, 54009 (Sept. 17, 2008). 

206. Here, the Agency's single source D&F relies on one exception to the rule against 

awarding a single award IDIQ greater than $112 million. Specifically, the Under Secretary states 

that "pursuant to 10 U.S.C. § 2304a(d)(3)(B)(ii), ... the IDIQ contract for JEDI will provide only 

for FFP task order for services for which prices are established in the contract for the specific 
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tasks to be performed." (AR Tab 16, D&F at 317.) 

207. The RFP, however, intentionally does not identify the "specific tasks to be 
performed" or even specify the services or the prices that the Agency will pay. Instead, the RFP 
contemplates that the menu of services available on the JEDI Cloud will constantly update 
during performance as the awardee daily or weekly adds new offerings to the contract to "keep[] 
pace with industry innovation and staying at the forefront of available technology." (AR Tab 25, 
Acquisition Strategy at 468; see also, e.g., AR Tab 32, JEDI Cloud Industry and Gov. QA Final 
RFP at 656 (Q#17: asking DoD to revise 5-day notification to a monthly notification of catalog 
changes, to prevent "multiple catalog submissions on a daily or weekly basis as new services are 
released"); id. at 664 (Q86-87) (asking how the government will handle changes to prices, terms, 
and services during the evaluation period).) 

208. But the RFP does not establish any price for these future services to be offered on 
the JEDI Cloud. It merely attempts to peg the government's prices to the awardee's future 
commercial market prices - an approach that the FAR does not countenance and that Congress 
sought to block by this prohibition. 48 C.F.R. § 15.403-3(c) ("[t]he fact that a price is included 
in a catalog does not, in and of itself, make it fair and reasonable," much less competitive). 

209. The D&F shows that the Under Secretary mistakenly believed that the catalogs 
would cover all services delivered across the full potential ten years of performance. (AR Tab 
16, D&F at 316 ("The CLINS for cloud offerings (i.e., IaaS, PaaS, and Cloud Support packages) 
will be priced by catalogs resulting from full and open competition, thus enabling competitive 
forces to drive all aspects of the FFP pricing . All catalogs will be incorporated at contract award 
and cover the full potential 10 years .").) 
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210. The catalog of cloud services solicited and the associated prices are by definition 
evolving and unpredictable. See, e.g., The Changing Faces of the Cloud, Bain & Company (Jan. 
25, 2017), https://www.bain.com/insights/the-changing-faces-of-the-cloud (last visited 12/6/18); 
10 Ways Cloud Computing Will Evolve in 2018, CMS Wire (Dec. 18, 2017), https://www.cms 
wire.com/information-management/10-ways-cloud-computing-will-evolve-in-2018/ (last visited 
12/6/18); Hidden Cloud Opportunities for Technology Service Providers, Gartner (June 20, 
2018), https://www.gartner.com/smarterwithgartner/7-hidden-cloud-growth-opportunities-for- 
technology-service-providers/ (last visited 12/6/18) (major cloud providers release 40 to 50 new 
features per month). 

211. To that end, the RFP does not contemplate fixed service catalogs. Instead, RFP 

Section H2 contemplates that the awardee will constantly add new services and remove others, 

with pricing for the new services to be determined when added: 

[W]hen new (including improved) IaaS, PaaS, or Cloud Support Package services 
are made publicly available to the commercial marketplace in the continental 
United States (CONUS) and those services are not already listed in the JEDI 
Cloud catalogs in Attachment J-l: Price Catalogs, the Contractor must 
immediately (no later than 5 calendar days) notify the JEDI Cloud Contracting 
Officer for incorporation of the new services into the contract in accordance with 
the Performance of Work Statement.... 

(AR Tab 35, RFP Am. 2 at 736.) 

212. Given the rapid evolution of cloud services, the RFP's contemplated procedure for 
updating the services may result in daily or weekly revisions to the menu of services offered on 
the JEDI Cloud contract. 

213. Thus, contrary to the D&F findings, the catalogs incorporated into the contract at 
the time of award will not have established prices for all services to be performed over the ten- 
year period. Moreover, the JEDI RFP does not identify the specific tasks to be performed. 
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214. Neither the price reduction clause nor the new service clause in the contemplated 
JEDI Cloud contract can substitute for task order competition or change the fact that the 
exception relied on by the Under Secretary does not apply to the JEDI Cloud procurement. (AR 
Tab 16, D&F at 316-17.) To the contrary, these very types of provisions led to the prohibition in 
the first instance. ( Compare AR Tab 16, D&F at 317 with OFPP, Best Practices for Multiple 
Award Task And Delivery Order Contracting at 6, https://www.gsa.gov/cdnstatic/BestPractices 
MultipleAward.pdf (last visited 12/6/18).) 

215. Congress excepted base contracts with established firm fixed prices for the 
specific tasks to be performed from its prohibition because in that limited circumstance the pre¬ 
award competition would determine the pricing of future orders, permitting the agency (and 
Congress) to have confidence (at the time of award) regarding the relative technical merit and 
cost of the competing offers over the entire period of performance. The JEDI Cloud 
procurement does not meet the exception. 

216. The Agency's improper D&F authorizing a single award under the JEDI Cloud 
RFP works competitive prejudice against Oracle. By limiting the number of awards available, 
the Agency deprived Oracle of the opportunity to compete for one of multiple JEDI Cloud 
awards, and all subsequent task order competitions issued among the multiple JEDI Cloud 
contractors. Weeks Marine v. U.S., 575 F.3d 1352, 1361-62 (Fed. Cir. 2009); WinStar 
Commc'ns, Inc. v. U.S., 41 Fed. Cl. 748, 762-63(1998) (holding protester was prejudiced where 
agency improperly adopted single-award IDIQ acquisition approach). 

WHEREFORE, Oracle requests that the Court declare that the D&F violates 10 U.S.C. 
§ 2304a(d)(3) and enjoin DoD from making a single award under the RFP absent compliance 
with 10 U.S.C. § 2304a(d)(3). 
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COUNT II 

The CO's Conclusion That The FAR Requires DoD To Adopt A Single IDIQ Award 
Acquisition Approach For The JEDI Cloud RFP Lacks A Rational Basis 

217. Oracle incorporates paragraphs 1 through 195 of the Complaint by reference. 

218. This Court must set aside any agency action that is "arbitrary, capricious, an abuse 
of discretion, or otherwise not in accordance with law" or "without observance of procedure 
required by law." 5 U.S.C. § 706(2)(A), (D). 

219. Section 2304a of Title 10 of the U.S. Code and FAR 16.504(c) require the use of 
a multiple awardee IDIQ contracting approach and task order competition "to the maximum 
extent practicable". 10 U.S.C § 2304a(d)(4). 

220. FAR 16.504(c)(l)(i) states that the contracting officer must (i) "give preference to 
making multiple awards" of an IDIQ contract under a single solicitation for the same or similar 
services to two or more sources to the "maximum extent practicable," and (ii) document the 
decision in the acquisition plan or acquisition file. 48 C.F.R. § 16.504(c)(l)(ii)(C). 

221. The statutory and regulatory requirement that the contracting officer " must " favor 
multiple award IDIQ contracts " to the maximum extent practicable " is in itself a material limit on 
contracting officer discretion. See, e.g., SMS Data Products Grp., Inc. v. U.S., 853 F.2d 1547, 
1553-54 (Fed. Cir. 1988) (interpreting "shall," "to the maximum extent practicable" obtain 
competition when reprocuring following a default termination to mean that "the contracting 
officer did not have unbridled discretion in conducting the reprocurement, but was required to 
conduct the reprocurement in the most competitive manner feasible ."); Palantir USG, Inc. v. 
United States, 129 Fed. Cl. 218, 269 (2016) ("The word 'maximum' in the phrase 'to the 
maximum extent practicable,' therefore, should not be ignored and read out of the statute. Given 
the congressional choice of the word 'maximum,' even when coupled with words like 
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'practicable' and 'appropriate,' agencies cannot ignore or superficially comply with the 
requirement... affd, 904 F.3d 980 (Fed. Cir. 2018). 

222. The Court's precedent instructs that the CO's justification for a single award IDIQ 
acquisition approach at issue here must find support in the record and demonstrate that the CO 
rationally balanced Congress' strong preference for multiple awards to the maximum extent 
practicable by objectively assessing the benefits and risks of both the multiple award and single 
award approach. See WinStar Commc'ns, Inc. v. U.S., 41 Fed. Cl. 748, 764 (1998) (ordering 
final judgment declaring contracting officer's determination regarding single award approach and 
GSA decision to award one IDIQ contract null and void as contrary to FAR 16.504(c)(1) and 
lacking a reasonable basis). The memorandum does neither. 

223. The CO's memorandum post-dates DoD public statements of the single JEDI 
Cloud IDIQ contract approach by at least four months. ( Compare AR Tab 18, JEDI Industry 
Day Slides at 349 (March 2018 outlining Agency intent to make a single award) with AR Tab 24, 
Single-Award Mem. (CO July 2018 memorandum for the record).) The substantial timing 
incongruity raises questions about the actual bases for the CO's decision. Citizens to Pres. 
Overton Park, Inc. v. Volpe, 401 U.S. 402, 420 (1971) ("review is to be based on the full 
administrative record that was before the secretary at the time he made his decision ."'): 
CRAssociates, Inc. v. United States , 95 Fed. Cl. 357, 'ill (2010) (an "essential premise of 
[Administrative Procedure Act ("APA")] review presupposes that the agency will establish its 
rationale at. or prior to. the time of its decision—not after ."). 

224. Although the CO cites three conditions that the CO concludes prevent the use a 
multiple award acquisition approach under FAR 16.504(c)(l)(ii)(B), the CO's one-sided analysis 
(i) lacks record support, (ii) contravenes the Agency's obligation to prefer multiple awards to the 
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maximum extent practicable, and (iii) competitively prejudices Oracle. WinStar Commc'ns, 41 
Fed. Cl. at 762 (holding that irrational single award decision created significant harm to 
competitor which lost opportunity to compete for multiple contracts). 

225. None of the findings offered by the CO overcome Congress' preference to apply a 
multiple award approach to the maximum extent practicable. Indeed, the record reveals that the 
CO's memorandum (created long after DoD decided to use a single award) is riddled with 
unsupported, deeply flawed calculations and findings. The CO failed to assess objectively the 
benefits and risks of each acquisition approach. This failure undermines each of the CO's post- 
hoc justifications. 

226. In the first purported justification for a single IDIQ contract approach, the CO 
concludes that "[mjore favorable terms and conditions, including pricing are likely to be 
proposed if a single award is made because: i) the need for vendor investment into DoD's 
requirements, and ii) marketplace conditions." (AR Tab 24, Single-Award Mem. at 453.) 

227. The CO based the conclusion on two faulty assumptions: (i) without a single 
award approach, the offerors will charge higher prices for the classified and tactical edge 
offerings in order to recoup their investment into proposing such offerings and (ii) "fierce 
competition is expected under a single award scenario." (Id. at 454-55.) 

228. The CO based the first assumption that a single award contract will result in lower 
pricing for classified and tactical edge offerings than task order competition on the false premise 
that DoD cannot require awardees to compete for particular task orders. (Id. at 454.) But as the 
Agency conceded to GAO, the FAR does not prohibit a task order competition process under 
which each awardee agrees to propose against future awards. (MOL at 34-35 (citing FAR 
16.505(b)); see also OFPP, Best Practices for Multiple Award Task And Delivery Order 
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Contracting at 14, https://www.gsa.gov/cdnstatic/BestPracticesMuItipleAward.pdf (discussing 
mandatory versus non-mandatory response to orders).) 

229. The CO also wrongly assumed that a single award approach would guarantee the 
awardee the ability to recover its investment to provide services supporting military operations 
(classified and tactical edge). But in statements to GAO, the CO conceded that DoD has no 
obligation beyond the IDIQ minimum of $1 million. (COSF at 2 (f 3).) The CO testified: "The 
guarantee for the JEDI Cloud requirement is a million dollars.... [Q: But there is no guarantee for 
tactical edge?] A: No. No separate guarantee for tactical edge.... the government is not 
subsidizing the investment for any offeror to develop its tactical edge, or classified capabilities 
for this specific requirement." (CO Test, at 197:16-198:5.) 

230. Although the JEDI Cloud contract does not guarantee what services the users will 
purchase or how many task orders the awardee will receive, the RFP requires each contractor to 
invest in the classified environment and tactical edge capabilities to meet the base contract 
requirement for tactical edge devices and classified offerings prior to award . {See, e.g., AR Tab 
35, RFP Am. 2 at 803-04 (requiring Category One tactical edge device in production by January 
11. 2019 and the Category Two tactical edge device in production by day one of post-award 
kickoff).) The absence of any guarantee for classified or tactical edge work in the base 
competition evidences a severe flaw in the CO's logic that a single award will result in better 
pricing for such devices by guaranteeing that the awardee will get the tactical edge work. 16 

231. Even if support existed for the CO's assumption that a single award approach 
would result in more favorable tactical edge pricing, the CO's analysis still fails because the CO 
did not balance both the positive terms and conditions of a multiple award approach against the 

16 If a work guarantee was necessary to obtain best pricing of classified services and tactical edge 
offerings, the Agency could have provided a guarantee in the contract. DoD did not. 
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purported negative terms. (AR Tab 24, Single-Award Mem. at 453-55.) This is unreasonable. 
See WinStar Comm'ncs, Inc. v. United States, 41 Fed. Cl. 748, 758 (1998) (noting that an agency 
cannot find more favorable terms with a single award approach without weighing the benefits of 
a multiple award approach). In discussing the benefits of task order contracting. OFPP noted 
that DOJ experienced a 16.7% cost savings on technology contracts through multiple award 
contracting versus single award contracting, which would equate to $1.67 billion in savings 
measured across the JEDI Cloud contract . (AR Tab 24, Single-Award Mem. at 455; see also 
OFPP, Best Practices for Multiple Award Task And Delivery Order Contracting, https://www. 
gsa.gov/cdnstatic/BestPracticesMultipleAward.pdf (last visited 12/6/18). 

232. DoD guidance identifies seven different benefits of competition - none of which 
the CO considers. (DoD's Guidelines for Creating and Maintaining A Competitive Environment 
(Dec. 2014) at 1-2, Hearing Ex. H.) Missing from the CO's analysis is any balancing of these 
benefits (including better quality services at lower cost) inherent in task order competition. 

233. The CO's reliance on expected competition for the base contract award cannot 
save the flawed analysis. If the expected competition of the base IDIQ contract sufficed to 
deviate from the Congressionally-mandated requirement to provide the maximum practicable 
preference for multiple awards, the exception would swallow the rule. Consequently, such a 
consideration is an invalid ground to overcome the preference. See WinStar Commc'ns, 41 Fed. 
Cl. at 758 ("The preference would be rendered meaningless if it could be overcome simply by 
pointing to such general concerns which apply to every procurement."). 

234. In the second purported justification, the CO concludes that the "expected costs of 
administration of multiple contracts outweighs the expected benefits of making multiple 
awards." (AR Tab 24, Single-A ward Mem. at 455.) 
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235. The CO contends that avoiding task order competition, "substantially drivfes] 
down acquisition and programmatic efforts necessary to issue each task order." (Id.) But the 
fact that multiple awards create greater administrative costs is not a valid basis to overcome the 
statutory preference for task order competition to the maximum extent practicable. "Implicit in 
Congress' direction to establish a preference for multiple awards is the conclusion that the 
benefits generally outweigh the 'common sense'" administration costs of multiple contracts. 
WinStar Commc'ns , 41 Fed. Cl. at 762; see also One Source Mech. Servs., Inc.; Kane Constr., B- 
293802, June 1, 2004, 2004 CPD $112 (sustaining protest challenging single award IDIQ 
approach). Thus, to overcome the preference, the CO must reasonably demonstrate that those 
additional costs outweigh the expected benefits . Here, the CO overstated the costs of task order 
competition and disregarded the benefits. 


236. The CO relied on a series of severely flawed and misleading calculations: 



Multiple Award IDIQ 

Single Award IDIQ 

Differential 

Cost Per Order 

$127,851.84 

$2,595.71 

$125,256.31 

Number of Orders 

4,032 

4,032 


TOTAL 

$515,498,618.88 

$10,465,884.98 

$505,032,733.90 


(AR Tab 24, Single-Award Mem. at 456.) 

237. By this unsupported calculation, the CO concludes that a single award approach 
purportedly will save DoD over $500 million and somehow "prevent 770 years' of delays to 
warfighters" across a ten-year contract. (Id.) 

238. The CO's assertions strain credulity. For instance, the CO reaches the patently 

baseless $500 million differential by claiming that DoD will have to expend 1688 hours 

awarding each multiple award task order versus 32 hours for a single award task order. The CO 

testified that she derived these hours from her "personal experience." (CO Test, at 322:1-5.) But 

the CO acknowledged that she has never purchased cloud services under an IDIQ contract 
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before, and offered no explanation for how her prior experience related to task order 
competitions of the cloud computing services DoD solicits here. (Id. at 312:10-17.) 

239. A GSA sponsored 2013 study revealed that agency time to award a task order 
averaged 119 to 168 hours depending on complexity . Streamlining Task and Delivery Order 
Solicitations under MA/IDIQ Contracts at 2, https://interact.gsa.gov/sites/default/files/ASI%20 
Advisory%20on%20Streamlining%20Final%206.9.2016.pdf (last visited 12/6/18). Conversely, 
the CO assumed 1688 hours for each task order competition - a 1318% increase that the CO 
could not explain . (AR Tab 24, Single-Award Mem. at 454.) 

240. The CO's claim that multiple award contracting will "prevent 770 years' of delays 
to warfighters" across a ten-year contract also makes little sense. The CO used a series of wholly 
unsupported inputs - 4,032 task orders * 70 days (difference between 100 days the CO assumes 
for a multiple award order versus 30 days the CO assumes for a single award order) to arrive at 
282,240 days. (Id.) Aside from the unsupported inputs, the reasoning seems to presume DoD 
will work one task order at a time, and not start any task order performance until DoD awards all 
4,032 task orders. 

241. The record also lacks any support for the CO's assumption that a competition for 
each task order will have the same duration and cost. At the hearing, the CO conceded: "You 
cannot predict across the board, how long that is going to take per task order." (CO Test, at 
328:9-11.) Likewise, the record fails to corroborate the CO's assumption that the Agency will 
issue 4,032 task orders over the ten-year period. (AR Tab 24, Single-Award Mem. at 452.) The 
funding profile in the Acquisition Plan casts serious doubt on the CO's task order estimates. 
(Compare AR Tab 23, Acquisition Plan at 439 (showing | 
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|) 17 with AR Tab 24, Single-Award Mem. at 452 | 

|.) The Agency offered no support for the CO's 
assumptions of 4,032 task orders of uniform size. 

242. Against these massive, contrived costs, the CO again claims competition will 
yield no benefits. 

243. In a final catch-all exception, the CO concludes that the FAR precludes a multiple 
award acquisition strategy with task order competition because a single award of the JEDI Cloud 
contract is in the best interest of the government. (AR Tab 24, Single-Award Mem. at 457-60.) 

244. The CO's suggestion that a multiple award approach would result in a prohibitive 
security risk or contravene DoD's interest fails for several reasons. 

245. First, several DoD entities and other federal agencies entities have awarded (or 
plan to award) contracts for multi-cloud offerings during JEDI Cloud competition undermining 
this purported prohibitive security risk. See e.g., Ross Wilkers, Navy awards commercial cloud 
deal , DefenseSystems (Sep. 28, 2018), https://defensesystems.com/articles/2018/09/28/gd-navy- 
commercial-cloud.aspx (last visited 12/6/18) (reporting BPA award for " a 'multi-vendor, multi¬ 
cloud ecosystem' in line with the Defense Department's overall commercial cloud push"); Nick 
Wakerman, DHS CIO Plan Multi-Cloud strategy, FCW (May 29, 2018) https://fcw.com/articles/ 
2018/05/29/dhs-zangardi-cloud.aspx (last visited 12/6/18). Presumably these agencies are not 
jeopardizing national security. Moreover, the DoD CIO's Memorandum, issued with the JEDI 
Cloud RFP, reports that "DoD will always have a multiple cloud environment" (CIO Memo, 
Protest Ex. K), and the Acquisition Strategy states that DoD "will continue to use disparate 

17 Pursuant to U.S. Court of Federal Claims App. C, ^ 4, Oracle has shaded the Complaint to 
identify proposed redactions of its competition sensitive and proprietary material, as well as 
material covered by the GAO Protective Order. DoD may seek additional redactions. 
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clouds." (AR Tab 25, Acquisition Strategy at 501.) And, in its Report to Congress about the 
JEDI Cloud acquisition, DoD stated that the Agency "is best served by a robust, competitive and 
innovative technology industrial base." (Final Cloud Combined Congressional Report at 4, 
Protest Ex. I.) 

246. Second, the OMB recently published its government-wide Cloud Smart strategy 
recognizing that multi-cloud environments are "effective and efficient": "Industries that are 
leading in technology innovation have also demonstrated that hybrid and multi-cloud 
environments can be effective and efficient." OMB Cloud Smart Strategy, https://cloud.cio.gov/ 
strategy/ (last visited 12/6/2018). Presumably OMB is not advising a practice that creates 
national security risks. 

247. Third, the vast majority of the cloud services DoD will procure under the JEDI 
Cloud RFP are not classified. To the extent that some national security work must be in one 
cloud, that DoD can readily address that at the task order level without removing all of DoD's 
work (e.g. HR systems) from competition and tying DoD to a single vendor. 

248. Fourth, the commercial market that DoD seeks to emulate has favored a multi¬ 
cloud environment based on many benefits, including better quality services, price flexibility, 
and security . 18 With one cloud, a provider failure can render all customer systems inoperable. 19 


18 See RightScale State of the Cloud Report , https://assets.rightscale.com/uploads/pdfs 
/RightScale-2018-State-of-the-Cloud-Report.pdf (last visited 12/6/18) ("81% of respondents 
have a multi-cloud strategy."); Kim Weins, Cloud pricing comparison: AWS vs. Microsoft Azure 
vs. Google Cloud vs. IBM Cloud, InfoWorld (Nov. 22, 2017), https://www.infoworld.com/article 
/3237566/cloud-computing/cloud-pricing-comparison-aws-vs-azure-vs-google-vs-ibm.html?page 
=2 (last visited 12/6/18) ("Developing a multi-cloud strategy is a critical component of cloud 
cost management efforts."). 

19 See, e.g., Amazon S3 Outage Has Broken A Large Chunk Of The Internet, Forbes (Feb. 28, 
2017), https://www.forbes.com/sites/ryanwhitwam/2017/02/28/amazon-s3-outage-has-broken-a-l 
arge-chunk-of-the-internet/#20fdc5b 1 c467 (last visited 12/6/18) (AWS S3 data center outage 
affecting major websites and services including Instagram, American Airlines, and Slack). 
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249. Notably, the DDS Deputy Director testified at GAO that the security risk did not 

arise from the multi-cloud approach but instead arose from DoD's inability to manage the multi¬ 
cloud approach. (Van Name Test, at 57:15-60:2.) DoD runs more than 500 different cloud 
efforts today. (AR Tab 25, Acquisition Strategy at 467.) The suggestion that DoD cannot 
handle two or three JEDI Cloud vendors strains credulity and hardly provides a basis for limiting 
competition as DoD can contract that effort if need be. A contractor administers the Defense 
Information Systems Agency MilCloud today. (AR Tab 44a, at 1003 

(noting that it is the MilCloud 2.0 Cloud Broker | 

id at 

250. As with the CO's other flawed findings, the CO's catch-all analysis also is one¬ 
sided, incomplete, and unreasonable because the CO fails to consider and weigh the benefits and 
savings gained through task order competition against the claimed concerns of multiple awards. 
WinStar Commc'ns, 41 Fed. Cl. at 759 ("the CO cannot rationally conclude that a single award is 
more beneficial to the government than multiple awards (16.504(c)(l)(vi)) without considering 
the benefits of multiple awards."). The CO neither quantifies the anticipated needs of managing 
the connections for multiple contractors, of transitioning data between clouds, of pooling data 
across DoD entities, nor the purported costs of additional training or complexity associated with 
more than one contractor, nor compares the claimed cost burdens to the benefits (and savings) 
resulting from task order competition. (AR Tab 24, Single-Award Mem. at 457-60.) 

251. In any event, this Court need not guess whether Congress believes the JEDI Cloud 
acquisition requires task order competition. In September 2018, after having considered DoD's 
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May 2018 Final Combined Report, Congress statutorily demanded that DoD " sustain fmultiple 
CSP1 competition through the [JEDI Cloud] period of performance": 

None of the funds appropriated or otherwise made available by this or any other 

Act may be obligated or expended by the Department of Defense to migrate data 

and applications to the proposed Joint Enterprise Defense Infrastructure or the 

Defense Enterprise Office Solutions cloud computing services until a period of 90 
days has elapsed following the date on which the Secretary of Defense submits to 
the congressional defense committees ... a detailed description of the 
Department's strategy to implement enterprise-wide cloud computing, including 
the goals and acquisition strategies for all proposed enterprise-wide cloud 
computing service procurements; the strategy to sustain competition and 
innovation throughout the period of performance of each contract, including 

defining opportunities for multiple cloud service providers and insertion of new 

technologies ; and an assessment of potential threats and security vulnerabilities of 
the proposed cloud computing strategy, and plans to mitigate such risks. 

Pub. L. No. 115-245, § 8137 at 50-51 (Sept. 27, 2018). 

252. In Section 8137 of the Act, Congress mandated that the acquisition strategies for 

DoD's enterprise-cloud computing contracts, including specifically the proposed JEDI Cloud 

contract, provide for competition and opportunities for multiple cloud providers throughout the 

contract's performance. The CO's Single Award Memorandum declares an acquisition strategy 

of competition among multiple JEDI Cloud providers contrary to the best interest of the United 

States. Thus, DoD's current acquisition strategy implemented in the JEDI Cloud RFP 

contravenes the acquisition strategy Congress directed in Section 8137. No basis exists to find 

DoD's acquisition strategy reasonable. 

WHEREFORE, Oracle requests that the Court declare that the CO's single award 
acquisition strategy violates 10 U.S.C. § 2304a(d)(4), FAR 16.504(c), Congress' latest direction 
in Pub. L. No. 115-245, § 8137 at 50-51 (Sept. 27, 2018), and otherwise lacks a rational basis, 
and enjoin DoD from pursuing an acquisition approach that fails "to sustain [cloud provider] 
competition and innovation throughout the period of performance" of the JEDI Cloud contract. 
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COUNT III 

RFP Gate Criterion 1.2 (High Availability And Failover) Exceeds DoD’s Minimum Needs 
And Unduly Restricts Competition In Violation Of CICA 

253. Oracle incorporates paragraphs 1 through 195 of the Complaint by reference. 

254. FedRAMP, U.S. Code, and precedent prohibit the Gate Criterion 1.2 requirement. 

255. This Court must set aside any agency action that is "arbitrary, capricious, an abuse 
of discretion, or otherwise not in accordance with law" or "without observance of procedure 
required by law." 5 U.S.C. § 706(2)(A), (D); 28 U.S.C. § 1491(b)(4). 

256. CICA demands that agencies solicit proposals "in a manner designed to achieve 
full and open competition." 10 U.S.C. § 2304(a); 10 U.S.C. § 2304a(c) (applying section 2304’s 
competitive procedure requirements to task order contracts). 

257. If an agency believes that "the property or services needed by the agency are 
available from only one responsible source or only from a limited number of responsible 
sources", the head of the agency must issue an appropriate justification and approval document 
prior to restricting the competition. 10 U.S.C. § 2304(c)(1). "In no case may the head of an 
agency—(A) enter into a contract for property or services using procedures other than 
competitive procedures on the basis of the lack of advance planning or concerns related to the 
amount of funds available to the agency for procurement functions." 10 U.S.C. § 2304(f)(4); 48 
C.F.R. § 6.302-1. A single source determination does not satisfy the requirement for a 
justification and approval under CICA. 48 C.F.R. § 16.504(c)( 1 )(ii)(D)(3). 

258. A '"[qualification requirement' means a Government requirement for testing or 
other quality assurance demonstration that must be completed before award of a contract." 10 
U.S.C. § 2319(a). To the extent that DoD (as here) seeks to impose qualification requirements to 
a solicitation, additional rules apply including that "the head of the agency shall, before 
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establishing a qualification requirement—(1) prepare a written justification stating the necessity 
for establishing the qualification requirement and specify why the qualification requirement must 
be demonstrated before contract award...." 10 U.S.C. § 2319(b)(1); see W.G. Yates & Sons 
Constr. Co. Inc. v. Caldera, 192 F.3d 987 (Fed. Cir. 1999) (declaring qualification requirement 
invalid where agency failed to follow statutory requirements). 

259. The U.S. Code makes clear that DoD must provide offerors an opportunity to 

establish satisfaction of such standards before the date specified for award of the contract : 

A potential offeror may not be denied the opportunity to submit and have 
considered an offer for a contract solely because the potential offeror (A) is not on 
a qualified bidders list, qualified manufacturers list, or qualified products list, or 
(B) has not been identified as meeting a qualification requirement established 
after October 19. 1984. if the potential offeror can demonstrate to the satisfaction 
of the contracting officer (or, in the case of a contract for the procurement of an 
aviation critical safety item or ship critical safety item, the head of the design 
control activity for such item) that the potential offeror or its product meets the 
standards established for qualification or can meet such standards before the date 
specified for award of the contract. 

10 U.S.C. §2319(c)(3). 

260. Gate Criterion 1.2 mandates that each offeror have, at the time of proposal 

submission, no fewer than (i) three physically existing data centers (ii) within the customs 

territory of the United States (iii) that are separated by at least 150 miles, (iv) capable of 

automated failover to the others, and (v) each "supporting at least one IaaS and one PaaS offering 

that are FedRAMP Moderate 'Authorized' by the Joint Authorization Board (JAB) or a Federal 

agency as demonstrated by official FedRAMP documentation." (AR Tab 35, RFP Am. 2 at 788; 

AR Tab 32, JEDI Cloud Industry and Gov QA Final RFP at 657 {see government response to 

Q26 and Q27); AR Tab 42, Gate Mem. at 943; Van Name Test, at 93:22-94:7.) The offeror must 

satisfy all five conditions by the time of proposal submission to pass the gate and compete for the 

JEDI Cloud contract. (Van Name Test, at 94:7-10.) 
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261. The Agency's rationale for the subfactor "is to validate that JEDI Cloud can 
provide continuity of services for DoD's users around the world." (AR Tab 42, Gate Mem. at 
943.) Specifically, DoD chose three data centers "to provide reliability and resiliency of services 
even in the unlikely circumstance that two datacenters are simultaneously affected." (Id.; Van 
Name Test, at 91:22-92:9.) But DoD's need for failover capabilities does not arise until DoD 
data is placed in the Cloud. (Van Name Test, at 92:10-15.) 

262. Gate Criterion 1.2 unduly restricts competition in three, independently improper 
ways. Gate Criterion 1.2 imposes the requirements well in advance of agency need, applies a 
prohibited qualification requirement without compliance with U.S. Code and FAR qualification 
requirements, and bears no relationship to DoD's actual minimum needs. 

263. First, as related to timing, DoD, in response to offeror solicitation questions, 
confirmed that its need for three operational unclassified data centers does not arise until after 
contract award : " The requirement is that the three unclassified data centers must be online and 
available thirty days after the conclusion of the post award kick-off event ." (AR Tab 32, JEDI 
Cloud Industry and Gov QA Final RFP at 671.) 

264. DoD has no legitimate, pre-contractual need for FedRAMP authorized offerings 
in three data centers. See USA Jet Airlines, Inc., Active Aero Grp., Inc., B-404666, Apr. 1, 2011, 
2011 CPD f 91 (sustaining protest challenging requirement for proof of industry quality 
certification at time of proposal submission where agency failed to show why offerors needed 
certifications prior to performance); LBM, Inc., B-286271, Dec. 1, 2000, 2000 CPD f 194 
(describing exclusionary effect of solicitation requirement that offeror have ISO-9000 prior to 
proposal submission where agency had no need for certification prior to contract performance). 

265. As related to the underlying requirement, FedRAMP, the government-wide 
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program which provides the government's standardized approach for security assessments, 
authorizations, and monitoring of cloud products, prohibits the exact requirement DoD seeks to 
apply here—requiring FedRAMP authorization as a precondition to bid. 

266. The FedRAMP Program Management Office explains this prequalification 
prohibition exists because procuring agencies have no legitimate need for FedRAMP authorized 
offerings until after contract award when the systems will hold federal data: " Federal Agencies 
cannot require CSPs to be FedRAMP authorized as part of their RFP but can state that a CSP 
needs to be FedRAMP authorized once federal data is placed in the system ." FedRAMP Tips & 
Cues Compilation 2015-2017 (Jan. 2018) at 7, https://www.fedramp.gov/assets/resources/ 
documents/FedRAMP_Tips_and_Cues.pdf (last visited 12/6/18); see also id. at 13 ("Agencies 
can request a CSP to have a timeline for obtaining an ATO but should not limit the request to 
CSPs with ATOs ."T 

267. FedRAMP authorization takes significant time and resources - both from the CSP 
and the government. FedRAMP "based on current resources and funding, only has the capacity 
to authorize a limited number of CSO [Cloud Service Offerings] a year." https://www.fedramp. 
gov/jab-authorization/ (last visited 12/6/18). 

268. Second, using FedRAMP authorization as a bidding prerequisite triggers 10 
U.S.C. § 2319. DoD, however, did not comply with those statutory provisions governing 
qualification requirements. 

269. The head of the Agency has not issued a written justification complying with the 
six mandatory steps of 10 U.S.C. § 2319(b). Moreover, even had the Agency complied with 10 
U.S.C. 2319(b), the JEDI Cloud RFP would still violate 10 U.S.C. § 2319(c), which states that 
(even where the head of the agency has properly justified a qualification requirement) a 
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procuring agency may not deny a potential offeror the opportunity to submit a proposal and 
requires the agency consider that proposal "if the potential offeror can demonstrate to the 
satisfaction of the contracting officer ... that the potential offeror or its product meets the 
standards established for qualification or the offeror can meet such standards before the date 
specified for award of the contract." 

270. Third, the FedRAMP authorization prerequisite called out in Subfactor 1.2 lacks 
relevance to DoD's actual minimum needs because DoD will not require the awardee to obtain 
FedRAMP authorization before DoD uses the Cloud. (Van Name Test, at 100:5-14 ("[W]e are 
not requiring, as part of the JEDI cybersecurity plan, that the winner go through the FedRAMP 
process before DoD uses the final solution"); id. at 101:3-6 ("Q: So if I understand correctly, 
your cybersecurity plan does not require FedRAMP authorization. A: Correct."); see also id. at 
100:13-14, 101:3-5, 101:13-15; JEDI Cloud Q&A Matrix at 13, Hearing Ex. B (Response to 
question 1577 ("The word choice between compliant versus authorized is deliberate. The Cyber 
Security Plan does not require prior accreditation or certification.").) 

271. Instead, the JEDI Cloud RFP and contract contemplate that DoD will work with 
the awardee after award t o ensure the proposed offerings and data centers comply with the JEDI 
Cloud Cyber Security Plan outside of the FedRAMP process. Specifically, post-award, DoD will 
assess the awardee's Cloud offering against the JEDI Cloud security requirements by a review 
and assessment of CDRL 11, the Security Authorization Package. (Van Name Test, at 101:7- 
103:15; see also AR Tab 5K, CDRL 11 at 156.) 

272. The JEDI Cloud contract does not require the awardee to submit its Security 
Authorization Package to DoD until "30 days after contract award," and DoD does not commit to 
any time frame for its review and assessment. (AR Tab 5K, CDRL 11 at 156; Van Name Test, at 
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102:2-103:15 ("Q: The government did not commit to complete review [of the awardee's plan] 
within 30 days of the contract award, correct? A: That's correct.").) 

273. Thus, Gate Criterion 1.2 requires offerors to establish FedRAMP authorization as 
a prerequisite to compete for the JEDI Cloud contract, even though the contract's own security 
requirements do not require the awardee to have FedRAMP authorization. (Van Name Test, at 
100:1-8, 101:3-15, 102:2-105:2.) 

274. DoD's market research establishes that commercial cloud offerings available to 
the government are "currently extremely limited as a result of accreditation," i.e., due to the 
FedRAMP authorization process. (AR Tab 20, Market Research Report at 370; id. at 378 
("Multiple respondents highlighted the fact that many of their platform services or third party 
marketplace offerings would not be available to the government due to the lengthy accreditation 
process (i.e., FedRAMP Moderate/High, DoD SRG, etc.)"); Van Name Test, at 94:11-21.) 

275. A proper market research report must consider how many offerors can potentially 
satisfy the gate criteria (at the most two or three providers) before limiting competition in such a 
manner. FAR 12.202 (declaring market research pursuant to FAR 10.001 "essential"); FAR 
10.001 (specifically requiring that market research " determine if sources capable of satisfying the 
agency's requirements exist ").) But DoD did not make this determination prior to release of the 
RFP. (Van Name Test, at 21:19-22, 22:13-21 ("And again, as part of writing this RFP, I 
intentionally didn't go and ask" the question of how many vendors can meet the FedRAMP 
Moderate requirement).) DoD thus also has not complied with the FAR market research 
requirements when describing its needs. 48 C.F.R. § 12.202. 

276. The first time DoD specified FedRAMP authorization as a Gate Criterion was in 
the final RFP issued on July 26, 2018. (Compare Draft RFP at 89, Hearing Ex. L (requiring 
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"FedRAMP Moderate compliant ") with AR Tab 35, RFP Am. 2 at 788 (requiring "FedRAMP 
Moderate 'Authorized' by the Joint Authorization Board (JAB) or a Federal agency as 
demonstrated by official FedRAMP documentation"); Van Name Test, at 95:11-17.) 

277. Consequently, DoD gave offerors less than two months to seek and obtain this 
government authorization in order to compete for the JEDI Cloud, an impossible endeavor given 
that the FedRAMP process takes six months' time or more. FedRAMP Accelerated A Case Study 
for Change Within Government, https://www.fedramp.gov/assets/resources/documents/ 
FedRAMP_Accelerated_A_Case_Study_For_Change_Within_Govemment.pdf (last visited 
12/6/18) (indicating authorization timeline of six months). 

278. GAO's decision does not engage with Oracle's arguments challenging Gate 
Criterion 1.2. Instead, GAO generally deferred to the Agency finding it "clear that the agency's 
basis for the subfactor 1.2 gate criteria relate to national security." See Oracle Am., Inc., B- 
416657 et. al., Nov. 14, 2018, 2018 WL 6040648, *16. But the DoD specific statutes prohibiting 
such requirements do not exempt procurements that DoD suggests may relate to national 
security. Moreover, DoD seeks to put 80% of its IT applications into this commercial item 
cloud, the vast majority of which will involve unclassified matters. 

279. The unduly restrictive requirements in Gate Criterion 1.2 cause Oracle significant 
competitive prejudice. Oracle began investing heavily in its Next Generation Government Cloud 
offerings in late 2017 and seeks to offer this latest state-of-the-art technology to JEDI Cloud 
users. (Oracle Deck at 12, Oracle Comments Exhibit A.) 

280. Among other benefits, Oracle's Next Generation Cloud will provide full-featured 
Database PaaS, Exadata as a Service, | 

I bare metal hosts, and other network security features. (Government Cloud Next 
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Generation PowerPoint at 3, Ex. 3 to Consol. Protest.) 

281. Oracle's Next Generation Cloud will consist of 


(Oracle Decl. at f 13, Oracle Comments Exhibit A.) 



284. Therefore, the Agency's unreasonable and unlawful inclusion of Gate Criterion 
1.2 causes Oracle "a non-trivial competitive injury which can be redressed by judicial relief." 
Weeks Marine, 575 F.3d at 1362. This Court can redress Oracle's competitive injury by 
enjoining DoD from making award under the current RFP and directing the Agency to remove or 
revise the unduly restrictive Subfactor 1.2 Gate Criterion. 

WHEREFORE, Oracle requests that the Court declare Gate Criterion 1.2 improper and 
unduly restrictive of competition in violation of CICA and enjoin DoD from making award under 
the RFP until DoD amends the RFP to eliminate or relax Gate Criterion 1.2. 


COUNT IV 

RFP Gate Criterion 1.1 (Elastic Usage) Exceeds DoD's Minimum Needs 
And Unduly Restricts Competition In Violation Of CICA 

285. Oracle incorporates paragraphs 1 through 195 of the Complaint by reference. 

286. This Court must set aside any agency action that is "arbitrary, capricious, an abuse 
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of discretion, or otherwise not in accordance with law" or "without observance of procedure 
required by law." 5 U.S.C. § 706(2)(A), (D); 28 U.S.C. § 1491(b)(4). 

287. Agencies must solicit proposals "in a manner designed to achieve full and open 
competition." 10 U.S.C. § 2304(a); 10 U.S.C. § 2304a(c) (applying section 2304's competitive 
procedure requirements to task order contracts). If an agency believes that "the property or 
services needed by the agency are available from only one responsible source or only from a 
limited number of responsible sources," the head of the agency must issue an appropriate 
justification and approval document prior to restricting the competition. Id. at § 2304(c)(1). "In 
no case may the head of an agency-(A) enter into a contract for property or services using 
procedures other than competitive procedures on the basis of the lack of advance planning or 
concerns related to the amount of funds available to the agency for procurement functions." Id. 
at § 2304(f)(4). 

288. DoD must "specify the agency's needs and solicit ... proposals in a manner 
designed to achieve full and open competition for the procurement" and "develop specifications 
in such manner as is necessary to obtain full and open competition...." Id. at § 2305(a)(l)(A)(i), 
(iii); 48 C.F.R. § 11.002(a)(l)(i). DoD may "include restrictive provisions or conditions only to 
the extent necessary to satisfy the needs of the agency or as authorized by law." 10 U.S.C. § 
2305(a)(l)(B)(ii); 48 C.F.R. § 11.002(a)(1)(H). 

289. In furtherance of the full and open competition policy, agencies may include 
restrictive requirements in a solicitation " only to the extent they are necessary to satisfy the 
agency's legitimate needs ." Am. Safety Council, Inc. v. U.S., 122 Fed. Cl. 426, 435 (2015) 
(finding solicitation clauses unduly restrictive); Redland Genstar, Inc. v. U.S., 39 Fed. Cl. 220 
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(1997) (agency failed to articulate rational connection between its needs and its departure from 
previous practice had restrictive effect on competition). 

290. This Court's review thus centers on a determination as to whether the agency 
restrictions serve a legitimate minimum agency need . Am. Safety Council, Inc., 122 Fed. Cl. at 
436; see also Charles H. Tompkins Co. v. U.S., 43 Fed. Cl. 716 (1999) (finding solicitation 
provisions overly restrictive). 

291. An agency also cannot require an offeror to demonstrate the ability to meet a 
requirement at a point in time prior to when such requirement becomes relevant to the agency. 
See, e.g., USA Jet Airlines, Inc., Active Aero Grp., Inc., B-404666, Apr. 1, 2011, 2011 CPD If 91. 

292. Gate Criterion 1.1 requires each offeror to demonstrate " for evaluation purposes " 
that the identified JEDI Cloud unclassified usage numbers are less than 50% of the Commercial 
Cloud Offering usage during the months of Januarv-Februarv 2018 as measured against three 
metrics: (i) Network - volume of commercial client traffic in bytes in and out of the controlled 
infrastructure; (ii) Compute - number of physical compute cores in use by applications; and (iii) 
Storage - data in bytes for each online, nearline, and offline. (AR Tab 35, RFP Am. 2 at 787.) 

293. Among other outsized usage requirements, this criterion compels each offeror to 

demonstrate an existing commercial cloud offering storage usage of 200 Petabytes offline across 
two months (January - February 2018). (Id.) For understanding, two Petabytes equates to the 
volume of information housed in all U.S. academic research libraries. 20 DoD does not require 
such storage on contract day one, much less sixteen months earlier . Indeed, the Acquisition 
Strategy estimates a fiscal year 2019 spend of (AR Tab 25, Acquisition Strategy at 

487.) The network, compute, and other storage requirements contain equally restrictive 

20 http://pcbunn.cithep.caltech.edu/presentations/giod_status_sep97/tsld013.htm (last visited 
12/6/18). 
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requirements designed to close this competition to all but a few of the very largest providers. 

294. Although the Subfactor 1.1 metrics are substantial, Oracle does not object to their 
application, only the timing of the application. The Agency seeks to apply these metrics as of 
January-February 2018; nine months before proposal submission and fifteen months before the 
anticipated award . The period selected is arbitrary, violates U.S. Code and FAR provisions 
governing solicitation requirements, and prejudices Oracle. 

295. In support of its Gate Criterion 1.1 metrics, the Agency states that these criteria 
ensure that: 1) the Cloud is capable of providing the full scope of services even under surge 
capacity during major conflict or natural disaster event; and 2) the Cloud experiences ongoing 
innovation and development and capability advancements for the full potential period of 
performance. (AR Tab 42, Gate Mem. at 940-42; Van Name Test, at 80:5-14, 88:19-89:1.) 

296. "[Sjurge capacity is the ability to meet sudden unexpected demands in usage," 
and these metrics seek to assess whether the offeror's Cloud can handle a certain number of users 
and data in a future, worst-case disaster scenario. (Van Name Test, at 80:15-81:9.) 

297. DoD's need for this capacity will not arise until after contract award, when DoD 
data is placed in the cloud. (Id. at 81:5-9.) Stated otherwise, as long as the offeror at the time of 
award has the excess capacity to meet the surge needs at an unpredictable period of time in the 
future, DoD's minimum need for the surge capacity will be met. (Id. at 82:2-12.) What 
necessarily matters is relative capacity at the time of performance need : not usage at least sixteen 
months before DoD will even issue its first task order. 

298. But Gate Criterion 1.1 does not measure which offerors can meet the Agency's 
needs at time of performance. For starters, the criterion measures dated, historic usage, but the 
RFP seeks future capacity . Moreover, the RFP measures which offerors meet the Agency's 
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usage metrics in January and February 2018 - well over a year prior to the offeror starting 
performance. Thus, although the stated rationale may justify including an evaluation factor 
measuring proposed excess capacity during performance and to understand whether the offeror 
intends to invest in the cloud, neither is a valid justification for using usage in January and 
February 2018 as a pre-award gate to compete for the JEDI Cloud. 

299. The Subfactor 1.1 evaluation will exclude offerors that can satisfy DoD's actual 
minimum performance needs from the competitive field. As written, an offeror that had 
customer usage in January and February 2018 slightly below the Subfactor 1.1 metrics, but 
whose commercial paying customer usage grows month over month such that the offeror would 
meet or exceed the metrics at the time of proposal submission or award, would fail the gate. 

300. Conversely, an offeror with customer usage in January and February 2018 slightly 
above the metrics, but which has a diminishing client base and could not meet the Agency's 
future surge needs at the time of award, would pass the gate. (Id. at 83:7-18; id. at 85:18-86:6.) 

301. The Gate Criterion 1.1 early 2018 usage metrics have no bearing on the offeror's 
capacity to meet DoD's actual compute, network, and storage needs in mid-2019 (when the 
award is anticipated) and beyond. 

302. The contemporaneous record contains no explanation for the months selected. 
The Agency has offered the assertion that use of these two months, which fell prior to the draft 
RFP release, prevents offerors from "gaming" their usage numbers in order to compete. (Id. at 
27:5-10; see also id. at 28:8-14 ("[I]f we were to change it to 60 days before proposal, again, it 
would be fairly easy for a vendor to have gamed out those numbers.").) 

303. The Agency's suggestion that offerors would effectively give services away to 
meet the RFP metrics lacks reason and does not provide a valid basis to arbitrarily narrow the 
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competitive field. In any event, other less restrictive means of evaluating the offeror's capacity 
and investment exist, yet the Agency elected not to structure the RFP in that manner. For 
instance, DoD could resolve its data manipulation concern by seeking data from January and 
February 2018 and a more recent period and asking offerors to explain any differences. 



(Oracle Deck at f19, Ex. A. to Oracle Comments.) 


305. 

I 

306. The Agency's improper decision to test each offeror's capacity based on usage in 
January and February 2018 (nine months before proposal submission and fifteen months before 
award) | 

307. Therefore, the Agency's unreasonable and unlawful inclusion of Gate Criterion 
1.1 causes Oracle "a non-trivial competitive injury which can be redressed by judicial relief." 
Weeks Marine, 575 F.3d at 1362. This Court can redress Oracle's competitive injury by 
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enjoining DoD from making award under the current RFP and directing the Agency to adjust the 
measurement for this unduly restrictive requirement. 

WHEREFORE, Oracle requests that the Court declare Gate Criterion 1.1 unduly 
restrictive of competition in violation of CICA and enjoin DoD from making award under the 
RFP unless DoD amends the RFP to eliminate or relax unduly restrictive Gate Criterion 1.1. 

COUNT V 

RFP Gate Criterion 1.6 (Marketplace) Exceeds DoD's Minimum Needs 
And Unduly Restricts Competition In Violation Of CICA 

308. Oracle incorporates paragraphs 1 through 195 of the Complaint by reference. 

309. DoD lacks authority to use the JEDI Cloud contract to delegate to a contractor the 
ability to establish a marketplace through which government entities may procure items without 
CICA compliance. Gate Criterion 1.6 is unlawful regardless of whether Oracle or any other 
competitors operate such a marketplace for their commercial customers. 

310. This Court must set aside any agency action that is "arbitrary, capricious, an abuse 
of discretion, or otherwise not in accordance with law" or "without observance of procedure 
required by law." 5 U.S.C. § 706(2)(A), (D); 28 U.S.C. § 1491(b)(4). 

311. CICA requires DoD to procure property and services by obtaining "full and open 
competition through the use of competition procedures in accordance with [CICA] and the 
[FAR]," unless Congress expressly has provided otherwise. 10 U.S.C. § 2304(a). 

312. FAR 7.503 further makes clear that "[contracts shall not be used for the 
performance of inherently governmental functions." 48 C.F.R. § 7.503(a). 

313. This Court's review of improper specifications centers on a determination as to 
whether an agency requires the specifications to meet an agency's legitimate needs . Am. Safety 
Council, Inc., 122 Fed. Cl. at 436; see Charles H. Tompkins Co. v. U.S., 43 Fed. Cl. 716 (1999) 
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("a solicitation may include restrictive provisions only to the extent necessary to satisfy the needs 
of the agency or as otherwise authorized by law"). 

314. Gate Criterion 1.6 requires offerors to demonstrate at the time of proposal 
submission that the offeror's Cloud Computing Offering includes an easy-to-use online 
marketplace from which JEDI Cloud users can procure and provision third-party platform 
offerings and third-party enterprise software service offerings. (AR Tab 35, RFP Am. 2 at 789- 
90; Van Name Test, at 110:8-111:1.) 

315. Specifically, Gate Criterion 1.6 requires each offeror to demonstrate three 
examples of existing platform offerings on the marketplace, three examples of advanced data 
analytics tools on the marketplace, three examples of bring your own license products, and three 
examples of free and open source platform and software offerings. (AR Tab 35, RFP Am. 2 at 
789-90; Van Name Test, at 110:8-13.) 

316. Per the Gate Memorandum, DoD seeks to evaluate "the range of offerings in such 
a marketplace," and confirm that "the user can easily go from the entry point... to deployment of 
the offering in a reasonable timeframe." (AR Tab 42, July 23, 2018 Gate Mem. at 947.) 

317. DoD cannot establish a legitimate need for the online marketplace required by 
Gate Criterion 1.6 because DoD lacks the authority to procure a market. By outsourcing the 
selection of third party software applications available for purchase by JEDI Cloud users to the 
Cloud provider, DoD has abdicated its obligation regarding the lawful procurement of supplies 
and the many legal and regulatory requirements that govern such a procurement. The RFP also 
lacks any provisions or controls to address the manifest organizational conflicts of interest that 
will arise from DoD delegating the control of DoD's software marketplace to a contractor. 

318. DoD has not provided any justification as to how the online marketplace 
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requirement in the JEDI RFP complies with CICA. In Section 846 of the Fiscal Year 2018 
NDAA, Congress authorized the Administrator of GSA, not DoD. to "establish a program to 
procure commercial products through commercial e-commerce portals. " directed GSA to 
implement the program a phased approach, and required GSA to "carry out the program ... 


through multiple contracts with multiple commercial e-commerce portal providers ...." See Pub. 
L. 115-91, § 846(a), Dec. 12, 2017, 131 Stat. 1483. 

319. Congress also tasked OMB and GSA to submit an implementation plan that 
discusses "whether any changes to, or exemptions from laws that set forth policies, procedures, 
requirements, or restrictions for the procurement of property or services by the Federal 
Government are necessary" to implement the plan. See id. at § 846(c). 

320. Section 846 defines a "commercial e-commerce portal" as "a commercial solution 
providing for the purchase of commercial products aggregated, distributed, sold, or manufactured 
via an online portal," and specifically excludes a portal managed by the government or for use 
only by the government. Id. at § 846(k)(3). 

321. Per the RFP, the JEDI Cloud offering will include the commercial vendor's online 
commercial marketplace from which JEDI Cloud users can "purchase [] software, and then 
provision" it onto their systems. (Van Name Test, at 109:11-22.) The RFP's online marketplace 
thus falls within Section 846's definition of an "e-commerce portal." 


322. The Gate Memorandum purportedly justifying the Subfactor 1.6 requirement does 
not address how the online marketplace complies with CICA or otherwise identify any other 
authority for this requirement. (AR Tab 42, Gate Mem. at 946-47.) Moreover, since learning of 
Oracle's objection, DoD has not cited any authority for its marketplace provision. 

323. GAO's decision does not address the Agency's authority to procure the online 
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marketplace. See Oracle Am., Inc., B-416657 et. al., Nov. 14, 2018, 2018 WL 6040648, *16- 
*17. Rather, GAO acknowledges that the Agency seeks the marketplace to "spin up" new 
systems and third-party software available through the online marketplace but suggests that the 
requirement does not prejudice Oracle because Oracle operates such marketplace for its 
commercial customers. Id. at *16. 

324. That commercial cloud providers (including Oracle) may offer an online software 
marketplace, and that DoD may want one, does not justify DoD including such a requirement in 
an RFP when DoD lacks authority to procure one. 

325. Contrary to the DoD's contentions, the requirement competitively prejudices 
Oracle. The Federal Circuit has made clear that injury stemming from an illegal solicitation term 
suffices to establish prejudice in a pre-award protest because contractors have a "definite 
economic stake in the solicitation being carried out in accordance with applicable laws and 
regulations." Weeks Marine, Inc. v. U.S., 575 F.3d 1352, 1362-63 (Fed. Cir. 2009). 

326. Here, Oracle, an actual bidder and provider of software to DoD, has an "economic 
stake" in DoD carrying out the JEDI Cloud RFP in accordance with applicable law and 
regulations, including those related to DoD's authority to procure an enterprise-wide commercial 
software marketplace. Any other outcome would result in a waiver of a valid challenge to an 
illegal solicitation term. Id. at 1363. 

327. Further, other aspects of the RFP, including the SOO, contain provisions related 
to the offeror's online marketplace. {See AR Tab 35, RFP Am. 2 at 744-45 (Clause H10) and AR 
Tab 27, Am. SOO at 612 (§ 3.18.2).) Section M requires the Agency to "evaluate the degree to 
which" the offeror's proposed solution reflects an understanding of the government's SOO 
requirements, when assessing each offeror an adjectival rating under Factors 2 through 7. (AR 
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328. The Agency's improper inclusion of Gate Criterion 1.6 causes Oracle "a non¬ 
trivial competitive injury which can be redressed by judicial relief." Weeks Marine, 575 F.3d at 
1362. Specifically, this Court can redress Oracle's competitive injury by enjoining DoD from 
making award under the current RFP and directing DoD to remove the unlawful requirement. 

WHEREFORE, Oracle requests that the Court declare the marketplace Gate Criterion and 
associated requirements unlawful and unduly restrictive of competition and enjoin issuance of a 
contract pending removal of Gate Criterion 1.6 and related requirements. 

COUNT VI 

The CO Failed To Investigate And Address The Significant Conflicts Of Interest Arising 
From Ubhi’s Role In The JEDI Cloud Acquisition 

329. Oracle incorporates paragraphs 1 through 195 of the Complaint by reference. 

330. The Agency involved a heavily conflicted individual (Deap Ubhi) as it JEDI RFP 
lead PM. In response, the CO issued a perfunctory, no impact finding following a less-than-one- 
page analysis, insufficient to address the legitimate concerns of competitors or the public. 

331. This Court must set aside any agency action that is "arbitrary, capricious, an abuse 
of discretion, or otherwise not in accordance with law" or "without observance of procedure 
required by law." 5 U.S.C. § 706(2)(A), (D); 28 U.S.C. § 1491(b)(4). 

332. To maintain the integrity of the procurement system, FAR 3.101-1 requires that 
"[gjovernment business shall be conducted in a manner above reproach and an impeccable 
standard of conduct ... with complete impartiality and with preferential treatment for none," and 
strictly prohibits even the appearance of conflicts of interest. 48 C.F.R. § 3.101-1. 
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333. Pursuant to FAR 9.504, contracting officers have a duty both to "[i]dentify and 
evaluate potential organizational conflicts of interest as early in the acquisition process as 
possible" and to "[a]void, neutralize, or mitigate significant potential conflicts before contract 
award." 48 C.F.R. § 9.504(a); Turner Const. Co. v. U.S., 645 F.3d 1377, 1386 (Fed. Cir. 2011) 
(noting duty to identify and evaluate potential conflicts and to avoid, neutralize, or mitigate 
conflicts are separate duties); NetStar-1 Gov't Consulting, Inc. v. U.S., 101 Fed. Cl. 511, 529 
(2011) (enjoining award where agency did not adequately investigate and mitigate conflict). 

334. The record documents (many of which the CO did not review as part of the 
investigation) present both an appearance of impropriety from Ubhi's involvement in the 
procurement and actual conflicts of interests that taint procurement's integrity. 

335. The CO's memorandum regarding these material conflicts and their impact did not 
involve any investigation at all. (AR Tab 33, Integrity Mem. at 682-83.) 

336. The CO considered only whether Ubhi joined the JEDI Cloud team more than one 
year after his leaving AWS, and upon checking that box, concluded that his connections to AWS 
did not negatively impact the procurement. (Id. at 683.) 

337. The CO's conclusion lacks a rational basis, not only because the investigation was 
incomplete, but also because the CO based that conclusion on two inaccurate findings: (1) Ubhi's 
involvement was limited to market research, (2) Ubhi promptly recused himself once AWS 
offered to purchase Ubhi's business. (Id. at 682-83.) 

338. The documentation the Agency produced during the GAO protest establishes that 
Ubhi both had a role in structuring the JEDI Cloud procurement and accessed competitor 
proprietary information immediately prior to returning to AWS. 
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339. As lead PM, Ubhi drove and advocated the single source cloud structure, and 
contributed to development of other source selection documents, including the problem 
statement, business case, and other strategy documents. (AR Tab 47c, Sept. 29, 2017 Slack 
message from Woods to Ubhi at 3105; see also id., Oct. 9, 2017 Slack message from Woods to 
Griffith at 3172; AR Tab 47b, Sept. 15, 2017 Slack message from Kasper at 2988; id. at Sept. 19, 
2017 Slack message between Ubhi and Kasper at 3002; AR Tab 47c, Oct. 10, 2017 Slack 
message from Ubhi at 3198; AR Tab 47a, Oct. 20, 2017 Slack message between Merker, 
Dickson-Kozloski, and Ubhi at 2959.) 

340. Ubhi contributed to the development of the JEDI Cloud requirements, and met 
with various DoD stakeholders to learn about their cloud-related needs. {See, e.g., AR Tab 47a, 
Sept. 28, 2017 Slack message from Ubhi to Oti at 2937; id., Oct. 24, 2017 Slack message from 
Van Name to Ubhi at 2960; id., Oct. 26-30, 2017 Emails between Ubhi, Boozell, Ellsworth, et al. 
at 2802, 2825; AR Tab 47b, Sept. 27, 2017 Slack messages between Ubhi, Mackay, and Griffith 
at 3061-71; AR Tab 47c, Oct. 6, 2017 Slack messages from Ubhi at 3168-69; id.. Sept. 29, 2017 
Slack messages between Ubhi, Kasper, and Woods at 3110-11; Van Name Test, at 41:11-42:3.) 

341. Ubhi managed untold amounts of nonpublic and acquisition sensitive JEDI 
Cloud-related information stored and shared on the acquisition's Google drive. {See, e.g.. Van 
Name Test, at 137:17-18, 138:8-16; AR Tab 47b, Sept. 15, 2017 Slack message between Ubhi 
and Kasper at 2979; AR Tab 47a, Sept. 21, 2017 Slack message from Ubhi at 2906; AR Tab 47b, 
Sept. 15, 2017 Slack message from Kasper at 2980; id., Sept. 20, 2017 Slack message from Ubhi 
at 3011-13, 3021.) 

342. Ubhi met with numerous potential JEDI Cloud competitors regarding their 
capabilities and approaches - including Microsoft, Google, and others - and had highly technical 
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discussions about their cloud solutions. (AR Tab 47a, Nov. 10, 2017 Email from Strausbaugh to 
Kasper and Ubhi at 2783; id., Oct. 25, 2017 Email from Ubhi to Black at 2896; AR Tab 47c, 
Sept. 28, 2017 Slack message from Ubhi at 3098.) 

343. Agency documents show that, as related to AWS-competitors, Ubhi routinely 
attacked both the competitor and the government individual who mentioned them. (AR Tab 47c, 
Oct. 5, 2017 Slack message from Ubhi at 3156-8; id.. Sept. 29, 2017 Slack message from Ubhi at 
3108; id., Oct. 4, 2017 Slack message from Ubhi at 3148.) 

344. The CO did not examine or discuss any of these aspects of Ubhi's role on the 
JEDI Cloud procurement. (AR Tab 33, Integrity Mem.) Instead, based on an incomplete review, 
the CO arbitrarily determined that Ubhi's involvement had no negative impact. The conclusion 
contradicts the FAR's mandate to "avoid strictly any conflict of interest or even the appearance of 
a conflict of interest in Government-contractor relationships." FAR 3.101-1. 

345. The CO also arbitrarily determined that Ubhi "promptly recused himself." (AR 
Tab 33, Integrity Mem. at 683.) 

346. Despite learning that a JEDI Cloud competitor offered to purchase a start-up 
business from the lead PM (a federal official) during the $10 billion procurement, the CO did not 
investigate these dealings - e.g., when and how the communications started, what AWS had 
offered Ubhi, and how and whether such discussions impacted the procurement. 21 (AR Tab 33, 
Integrity Mem. at 682; CO Test, at 261:21-262:4; id. at 250:18-251:2.) 

347. Although the CO's Integrity Memorandum suggests that the discussions occurred 
in late October 2017, the only evidence the CO reviewed - Ubhi's October 31, 2017 recusal letter 

21 The targeted Ubhi business (Tablehero) competes with an Oracle business unit called Oracle 
Hospitality, a company that Ubhi has publicly criticized on Twitter. The GAO record was 
devoid of any investigation by the CO into Tablehero's activities and whether Ubhi's connection 
to that business posed a conflict with his participation in the JEDI Cloud acquisition. 
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- does not state when Ubhi began negotiating with AWS, or how long Ubhi waited before 
recusing himself. (See AR Tab 45, Ubhi Recusal at 2773-74.) Instead, Ubhi indicated that he 
"may soon engage in further partnership discussions" with AWS revealing that Ubhi had 
discussions prior to the recusal. {See AR Tab 45, Ubhi Recusal at 2773-74.) 

348. Neither of the Agency's witnesses at the GAO hearing knew when or how the 
discussions began. (Van Name Test, at 151:6-11; CO Test, at 261:2-18.) 

349. Even if Ubhi recused himself just a few days after he entered into renewed 
transactional discussions with AWS, the difference in days could call into question the propriety 
of any number of Ubhi's official actions at DDS. For example, Ubhi sent his recusal letter on 
October 31, 2017, just two business days after DDS provided Ubhi's draft RFI to DoD leadership 
{see AR Tab 47e, Oct. 27, 2017 Email from Kasper to Berrios at 3311-12), and three business 
days after Ubhi participated in a highly technical discussion with Google. (AR Tab 47a, Oct. 25, 
2017 Email from Ubhi to Black at 2896.) 

350. A reasonable investigation likely would have confirmed (as Ubhi's message 
indicates) that Ubhi and AWS had "partnership discussions" at earlier points in Ubhi's 
employment with DDS and that, had DDS implemented a reasonable screening process, Ubhi 
never would have had any involvement with the JEDI Cloud acquisition. 

351. Given the timing of his reemployment with AWS in November 2017, Ubhi and 
AWS also likely engaged in employment discussions while Ubhi supported the JEDI Cloud 
effort. But the CO also did not investigate these interactions. Indeed, the CO's investigation 
does not assess or even mention Ubhi’s re-emplovment bv AWS at all . 

352. When a federal employee has an offer or seeks employment with a prospective 
contractor, the conflict of interest regulations at 5 C.F.R. § 2635.600 et seq. govern. Thus, the 
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CO's limited focus on the one-year restriction in 5 C.F.R. § 2635.502 is arbitrary and capricious. 
Pursuant to 5 C.F.R. § 2635.602(a)(1): 

[A]n employee who is seeking employment or who has an arrangement 
concerning prospective employment must comply with the applicable recusal 
requirements of §§ 2635.604 and 2635.606 if particular matters in which the 
employee will be participating personally and substantially would, to the 
employee's knowledge, directly and predictably affect the financial interests of a 
prospective employer or of a person with whom the employee has an arrangement 
concerning prospective employment. 

353. Without investigating when the AWS-Ubhi business discussions began or 
whether AWS had an existing arrangement concerning Ubhi's future employment prior to 
October 31, 2017, the CO could not reasonably conclude that Ubhi promptly recused himself. 

354. Also absent from the CO's conflict assessment is any consideration of the non¬ 
public information Ubhi accessed prior to rejoining AWS in late November 2017. (AR Tab 33, 
Integrity Mem.) 

355. The hard facts demonstrate that, during his tenure at DDS, Ubhi had unfettered 
access to competitively valuable information about the Agency's own needs and other 
competitors' JEDI Cloud solutions, all of which would provide AWS with an unfair competitive 
advantage against all other offerors, including Oracle. 

356. Where, as here, the facts suggests that a competitor may have an unfair 
competitive advantage due to relationships with former government officials, FAR Subpart 3.1 
operates in conjunction with the Organizational Conflict of Interest ("OCI") provisions of FAR 
Subpart 9.5. See Northrop Grumman Sys. Corp ., B-412278.8, Oct. 14, 2017, 2017 CPD U 312 
("the standard for evaluating whether a firm has an unfair competitive advantage under FAR 
subpart 3.1 stemming from its hiring of a former government employee is virtually 
indistinguishable from the standard for evaluating whether a firm has an unfair competitive 
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advantage arising from its unequal access to information ... under FAR subpart 9.5."); see also 
Health Net Fed. Servs., LLC, B-401652.3, B-401652.5, Nov. 4, 2009, 2009 CPD1220. 

357. "In this regard, where a firm may have gained an unfair competitive advantage 
through its hiring of a former government official, the firm can be disqualified from a 
competition based upon the appearance of impropriety which is created by this situation, even if 
no actual impropriety can be shown...." Int'l Res. Grp., B-409346.2 et al., Dec. 11, 2014, 2014 
CPD If 369 (sustaining protest where "former [agency] director potentially had access to 
competitively useful non-public information, and the record shows that the CO failed to analyze 
the full extent of the former director's involvement in the procurement."). 

358. The Agency has conceded that the CO did not investigate whether AWS' 
employment of Ubhi creates an appearance of impropriety or conflict of interest, arguing such a 
review is premature: "Whether or not another potential Offeror may have had an unfair 
competitive advantage as a result of hiring Mr. Ubhi is not ripe for the CO's investigation or a 
GAO determination." (MOL at 75; see also COSF at 38 (fflf 130-32).) 

359. The plain language of FAR 9.504 demands the opposite conclusion, as that 
provision directs contracting officers to: "Identify and evaluate potential organizational conflicts 
of interest as early in the acquisition process as possible ." 48 C.F.R. § 9.504(a)(1) (emphasis 
added). Indeed, this Court has recognized that the FAR directs contracting officers to '"figure 
out potential organizational conflicts of interest before a solicitation is issued and either mitigate 
potential conflicts before award, include restrictions in the solicitation to avoid the conflict of 
interest, or disqualify an offeror from a competition.'" NetStar-1 Gov't Consulting, Inc. v. U.S., 
101 Fed. Cl. 511, 521 (2011) (Allegra, J.) (quoting Ralph C. Nash & John Cibinic, Conflicts of 
Interest: The Guidance in the FAR, 15 No. 1 Nash & Cibinic Rep. K 5 (2001)). 
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360. This is for good reason: 

The FAR requires early identification of a potential significant OCI because it 
recognizes that once proprietary information has crept into the competitive 
process, the imbalances so created are difficult to isolate and counteract. Unlike in 
Homer's Greece of old, there are no Elysian Fields here, where contractors may 
go to wipe from their memories information regarding their competitor's pricing 
information. It thus stands to reason that the later a significant OCI is discovered, 
the harder an agency must work to address the harm caused thereby. 

NetStart-1 Gov't Consulting, 101 Fed. Cl. at 528. 

361. The CO's failure to investigate the conflict was arbitrary and capricious. Id.; see 
also Jacobs Tech. Inc. v. U.S., 100 Fed. Cl. 198, 212 (2011) (sustaining protest where agency's 
"decision not to conduct further OCI analysis lacked a rational basis," even when contracting 
officer "could still perform an OCI analysis prior to contract award," because "the Contracting 
Officer is required to evaluate any potential OCI as early in the reprocurement as possible"). 

362. The CO did not interview Ubhi; she did not review Ubhi's communications during 
the acquisition or the documents he drafted; she did not investigate how and when AWS first 
approached Ubhi to purchase his company or how and when AWS first approached Ubhi to 
rejoin the company; she did not identify and review the JEDI Cloud documents to which Ubhi 
had access; she did not consider Ubhi's current employment with AWS or whether he joined 
AWS with competitively useful information. (CO Test, at 208:1-6, 214:18-19, 223:12-14, 
247:6-7; 250:18-251:11, 262:3-4; 262:20-263:6; Supp. COSF at 12 (If 33).) 

363. Because the CO, "entirely failed to consider an important aspect of the problem 
[and] offered an explanation for [her] decision that runs counter to the evidence before the 
agency," the analysis must be set aside. See Ala. Aircraft Indus., 586 F.3d at 1375. 

364. The Agency's failure to adequately investigate and address this conflict of interest 
prejudices Oracle. See, e.g., NetStar-1 Gov't Consulting, 101 Fed. Cl. at 529 ("A long line of 
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cases holds that when a potential significant OCI is identified, prejudice stemming from that OCI 
is presumed"); see also Jacobs Tech. Inc., 100 Fed. Cl. at 213 (agency's "failure to conduct 
additional OCI analysis" prejudiced pre-award protester because [ujntil the agency conducts 
additional OCI analysis, [protester] is not assured that it is competing on a level playing field"). 

365. Unless and until the Agency completes an adequate investigation to determine 
whether Ubhi's involvement has impacted the integrity of the JEDI Cloud acquisition, no 
competition can be a fair competition, and all offerors suffer "a non-trivial competitive injury 
which can be redressed by judicial relief." Weeks Marine, 575 F.3d at 1362. 

366. This Court can redress Oracle's competitive injury by enjoining DoD from 
making award under the current RFP unless and until the Agency adequately investigates and 
resolves any conflicts arising from Ubhi's involvement in the JEDI Cloud acquisition. See 
Jacobs Tech. Inc., 100 Fed. Cl. at 213. 

WHEREFORE, Oracle requests that the Court declare the CO's conflict of interest 
investigation inadequate and enjoin DoD from awarding a contract under the RFP until DoD 
investigates and resolves the Ubhi conflicts of interest. 

COUNT VII 

The CO Failed To Investigate And Mitigate The Significant Conflicts Of Interest Arising 
From DeMartino’s Involvement In The JEDI Cloud Procurement 

367. Oracle incorporates paragraphs 1 through 195 and 329 through 366 of the 
Complaint by reference. 

368. Anthony DeMartino, variously the Chief of Staff for the Secretary and Deputy 
Secretary of Defense and a former AWS consultant, participated personally and substantially in 
the acquisition by, among other things, advocating procurement strategies, participating 
substantively in JEDI Cloud meetings and briefings, and editing official communications and 
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other procurement-related documents. DeMartino's involvement violated the U.S. Code and 
ethical regulations. The CO's less-than-one-page assessment of DeMartino's conflict of interest 
fails to consider material information and is arbitrary and capricious. 

369. This Court must set aside any agency action that is "arbitrary, capricious, an abuse 
of discretion, or otherwise not in accordance with law" or "without observance of procedure 
required by law." 5 U.S.C. § 706(2)(A), (D); 28 U.S.C. § 1491(b)(4). 

370. To maintain the integrity of the procurement system, FAR 3.101-1 mandates 
government business "be conducted in a manner above reproach, with complete impartiality and 
with preferential treatment for none," requires "an impeccable standard of conduct," and strictly 
prohibits even the appearance of conflicts of interest. 48 C.F.R. § 3.101-1. 

371. The record documents (many of which the CO did not consider in the 
investigation) evidence an appearance of impropriety by DeMartino and an actual conflict of 
interest that tainted the procurement. 

372. Yet, the CO summarily concluded that "DeMartino's involvement did not 
negatively impact the integrity of the JEDI Cloud acquisition" based on the unsupported 
assumption that DeMartino's involvement was "ministerial," and that "he did not participate 
personally and substantially in the procurement." (AR Tab 33, Integrity Mem. at 681.) 

373. This conclusion contravenes the hard facts, and fails based on the CO's failure to 
conduct a meaningful investigation. The CO did not talk to DeMartino or review his emails or 
other documents to test her understanding of his role in the acquisition. (CO Test, at 291:11-14; 
id. at 300:2-9 ("I didn't investigate ... all of the emails and everything that he sent.... I wasn't 
aware of this ... article from anyone at Amazon.... I largely relied on conversations that I had 
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with the DSS legal counsel who provided advice in concert with SOCO."); Supp. COSF at 12 (^f 
33) ("there are relatively few documents that I considered in my investigation").) 

374. The CO does not even remember when, or exactly how, the issue of DeMartino's 
conflict of interest came to her attention. (CO Test, at 273:16-22, 274:1-5.) 

375. The CO had not seen DoD's SOCO warning to DeMartino. (Id. at 274:12- 
275:13.) The CO did not talk to SOCO. 

376. Due to his past AWS ties, DeMartino received an ethics letter in April 2017 
(before JEDI commenced) warning DeMartino that he could not work on matters involving 
AWS without SOCO's prior permission: 

This email is to alert you to and assist you in avoiding potential conflicts of 
interest between your duties as a Government official and your actual or imputed 
financial interests and affiliations... In this instance, you may have a regulatory 
prohibition under 5 C.F.R. §2635.502 on participating in matters where one of the 
entities for whom you served as a consultant during the last year is or represents a 
party to the matter. In particular, Amazon, Palantir and Bloomberg do business 
with DoD, and therefore, you should be vigilant and consult with our office 
before participating in any matters involving these entities until the one year 
period has expired. 

(AR Tab 51, April 24, 2017 email from Irvine to DeMartino at 24341.) 

377. The regulations provide that "[w]here an employee knows that...a person with 
whom he has a covered relationship" is a party to a "particular matter," and that "the 
circumstances would cause a reasonable person with knowledge of the relevant facts to question 
his impartiality in the matter" absent appropriate authorization. 5 C.F.R. § 2635.502(a). 22 

378. The regulations apply to "the formative stages of particular matters," because 


22 Office of Government Ethics ("OGE"), Conflicts of Interest Considerations: Law Firm or 
Consulting Employment (last updated June 22, 2018), https://www.oge.gov/web/OGE.nsf/ 
0/53BE4061E9EFDEB4852582B400626DAA/$FILE/Law%20Firm%20or%20Consulting%20E 
mployment.pdf (last visited 12/6/18) (providing that former consultants may not participate in 
matters involving their former clients absent advance approval). 
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"[m]uch of the work with respect to a particular matter is accomplished before the matter reaches 
its final stage." OGE Opinion 80 x 4, June 13, 1980 (finding that participating in briefings and 
commenting on the Statement of Work constitutes personal and substantial involvement). 23 

379. The regulations require "appropriate steps to avoid an appearance of loss of 
impartiality in the performance of his official duties." 5 C.F.R. § 2635.501(a). 

380. As a former AWS consultant, DeMartino had a covered relationship with AWS. 
See id. § 2635.502(b)(l)(iv) ("An employee has a covered relationship with.... Any person for 
whom the employee has, within the last year, served as ... consultant"). 

381. DeMartino should not have participated in any matters involving AWS until at 
least January 2019, absent prior authorization from SOCO. 

382. But DeMartino did not follow SOCO's direction or the applicable ethical 
standards. Instead, DeMartino participated in the JEDI Cloud procurement for over six months, 
and then - after reporters submitted FOIA requests about his involvement - raised the issue with 
SOCO and SOCO directed his recusal. (Compare AR Tab 51, April 24, 2017 email from D. 
Irvine to A. DeMartino at 24341 with Supp. COSF at 6 (f 13).) 

383. Participating personally means to participate "directly"; participating 
"substantially" means that the employee's involvement is of significance to the matter, "or forms 
a basis for a reasonable appearance of such significance." OGE Opinion 96 x 21, Nov. 5, 1996, 24 

384. A number of different activities qualify as personal and substantial participation. 
For instance, advocating for the acceptance of a program plan qualifies as personal and 
substantial participation. OGE Opinion 96 x 21, Nov. 5, 1996. So does reviewing 

J 'https://www.oge.gov/web/oge.nsf/Legal%20Advisories/83EC5F97C6A9626685257E96005FB 
B90/$FILE/3e06845571dd4cb2a25fc7245cb9e0615.pdf?open (last visited 12/6/18). 
24 https://www.oge.gov/web/oge.nsf/Legal%20Advisories/0DBDD3F25EB8971885257E96005F 
BE98/$FILE/b491b2086be74d4791507906d501ef3c3.pdf?open (last visited 12/6/18). 
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recommendations and issuing communications. OGE Opinion 83 x 12, Aug. 3, 1983. 25 

385. DeMartino directed critical parts of the acquisition as the Chief of Staff to the 
organization driving DoD's cloud strategy. (AR Tab 51, Nov. 10, 2017 Email from DeMartino 
to Sweeney at 24386 ("DSD is driving the Cloud initiative"); see CO Test, at 281:21-282:18.) 

386. DeMartino received and reviewed acquisition sensitive information. (See, e.g., 
AR Tab 47e, Oct. 27, 2017 Email from Kasper at 3311-12.) 

387. DeMartino obtained procurement briefings for the Deputy Secretary, and 
participated in JEDI Cloud meetings. (AR Tab 51, Nov. 10, 2017 Email from DeMartino to 
Lord, Daigle, and Lynch (showing that DeMartino participated in Cloud discussions related to 
the Acquisition Strategy, Security Strategy, Business Case, and single or multiple source); AR 
Tab 47a, Sept. 27, 2017 Slack message from Woods at 2922 ("Chris and I are meeting with Tony 
DeMartino at 3 PM for 15 minutes"); Van Name Test, at 146:3-20.) 

388. DeMartino provided input into and edits regarding official communications and 
other documents related to the JEDI Cloud procurement. (AR Tab 51, Apr. 2, 2018 Email from 
DeMartino to Mooney at 24364; id. at 24362-63 (document with DeMartino comments); id., 
Feb. 14, 2018 Email from DeMartino to Woods and Daigle at 24400 (providing input on industry 
day materials); id., Feb 14, 2018 Email from DeMartino to Woods and Daigle at 24398 
(directing DDS to hold release until DeMartino provided input).) 

389. DeMartino provided input into the press strategy for the acquisition. (AR Tab 
47f, Oct. 25, 2017 Email from Gleischman to Woods, DeMartino, et al. at 3827 ("Tony, I know 
you were making edits this morning - can you share what you have with Chris...."); id., Oct. 26, 
2017 Email from Woods to DeMartino, et al. at 3876 ("Tony and Fran, Please see revised 

25 https://www.oge.gov/web/oge.nsf/Legal%20Advisories/486F71347E36660185257E96005FBB 
E0/$FILE/8a664c07fd4040008b68a00b4a4f30795.pdf?open (last visited 12/6/18). 
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version attached. What do you think?"); AR Tab 47e, Oct. 25, 2017 Email from DeMartino to 
Woods at 3315 ("Sharon - I've read through it and have some thoughts on how to restructure").) 

390. DeMartino's involvement in the JEDI procurement violated these standards. 

391. Had the CO reasonably investigated DeMartino's role as the law required, the CO 
would have found that DeMartino personally and substantially participated in the acquisition in 
violation of FAR 3.101-1, the ethics rules and SOCO's express direction. 

392. The CO's failure to reasonably investigate and resolve the DeMartino conflict 
prejudices Oracle. See Jacobs Tech. Inc., 100 Fed. Cl. at 213 (finding in a pre-award protest that 
the "failure to conduct additional OCI analysis" prejudiced the protester because absent an 
adequate analysis the protester "is not assured that it is competing on a level playing field"). 

WHEREFORE, Oracle requests that the Court declare the DeMartino investigation 
inadequate and enjoin DoD from making award under the RFP until the CO investigates and 
meaningfully resolves the DeMartino conflict of interest. 

VII. PRAYER FOR RELIEF 


Oracle, accordingly, respectfully requests that this Court: 

A. Issue the declaratory and injunctive relief set forth above; and 


B. Provide such other and further relief as the Court deems just and proper. 


Dated: December 6, 2018 
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